Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.

Local Out‑Of‑Bounds Write in MPEG4 Codec

Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Improper Input Validation in Samsung Message Allows Physical Attackers to Access Sensitive Information

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

Local Out-of-Bounds Memory Write in Samsung VC1 Codec

Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Out‑of‑Bounds Write in Samsung libsmkvextractor.so

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Privilege Escalation via Improper Permission Handling in CmcCore

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

Out-of-Bounds Memory Access in Samsung Mobile Sound Separation Library

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

Out-of-Bounds Memory Write in Samsung HEIF Decoder Due to Improper Input Validation

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local File Access via Improper Control in Samsung DownloadProvider

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

Local Access Control Weakness Exposing Sensitive Information via CocktailBarService

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

Out-of-Bounds Write in libcodec2-sec-flacdec.so Allowing Local Memory Corruption

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Out‑of‑Bounds Write in libsmkvextractor.so Enables Local Code Execution

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

Out-of-Bounds Write in Samsung TTS Library Enables Local Arbitrary Code Execution

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

Improper Input Validation Leading to Local Arbitrary Code Execution in Samsung’s HEIF Decoder

Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.

Local Arbitrary Code Execution via Improper Input Validation in Samsung HEIF Decoder

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.

Use-After-Free in Samsung WSM Service Enables Local Code Execution

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.

Local Access Control Failure Enabling Arbitrary Application Installation via ManagedProvisioning

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

Improper Access Control Allows Local Attackers to Connect to PC via Link to Windows

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction.

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.