Insufficient Permission Vulnerability in CmcCore by Samsung
CVE-2026-21121

6.9MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
12 October 2026

What is CVE-2026-21121?

The CmcCore component by Samsung exhibits an improper handling of insufficient permissions prior to the SMR October 2026 Release 1. This vulnerability enables local attackers to exploit privileged application programming interfaces (APIs) without proper authorization, potentially leading to unauthorized access and manipulation of system functionalities.

Affected Version(s)

Samsung Mobile Devices SMR Oct-2026 Release in Android XR 14

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.