Improper Input Validation in PACM Affects Samsung Devices
CVE-2026-20980

7HIGH

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
4 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-20980?

A vulnerability in Samsung's PACM prior to the SMR Feb-2026 Release 1 allows a physical attacker to exploit improper input validation. This flaw permits the execution of arbitrary commands, potentially compromising the integrity and security of affected devices. Users are advised to update to the latest software version to mitigate this risk.

Affected Version(s)

Samsung Mobile Devices SMR Feb-2026 Release in Android 14, 15, 16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

samsung-android-lpe
Created by Vikramaditya015

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.