Improper Access Control in SLocation by Samsung
CVE-2026-20970

6.8MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
9 January 2026

What is CVE-2026-20970?

An improper access control vulnerability exists in Samsung's SLocation software, allowing local attackers to execute privileged APIs. This security flaw affects all versions prior to the SMR Jan-2026 Release 1, potentially enabling unauthorized access and manipulation of sensitive functionalities within the application. Users are urged to update to the latest version to safeguard against potential exploitation.

Affected Version(s)

Samsung Mobile Devices SMR Jan-2026 Release in Android 15, 16

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.