Out-of-Bounds Write Vulnerability in libsaviextractor.so by Samsung
CVE-2026-21090

4.4MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
9 September 2026

What is CVE-2026-21090?

A vulnerability exists in libsaviextractor.so prior to the SMR Sep-2026 Release 1, which permits local attackers to write to memory locations outside of the intended buffer. This can potentially lead to memory corruption or other unintended behaviors in affected systems, posing risks to security and system integrity.

Affected Version(s)

Samsung Mobile Devices SMR Sep-2026 Release in Android 14, 15, 16, 17

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V4

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.