PatchTheCVECVE-2026-21072: Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers
28
Routine
HIGH 7.8MITIGATE
CVE-2026-21072 is a high-severity flaw (CVSS 7.8) affecting android. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 96%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2026-08-10 |
| Last modified | 2026-10-23 |
Publisher (CNA): Samsung Mobile · Vendor: samsung
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
samsung android MITIGATE
Affected: 14.0 · 14.0 smr-apr-2022-r1 · 14.0 smr-apr-2023-r1 · 14.0 smr-apr-2024-r1 · 14.0 smr-apr-2025-r1 · 14.0 smr-apr-2026-r1 · 14.0 smr-aug-2022-r1 · 14.0 smr-aug-2023-r1
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-0163 CRITICAL 9.8 MITIGATE In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free
- CVE-2026-21061 MEDIUM 6.5 MITIGATE Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access
- CVE-2026-21068 HIGH 7.8 MITIGATE Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers
- CVE-2026-21065 HIGH 7.8 MITIGATE Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write
- CVE-2026-21066 HIGH 7.8 MITIGATE Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers t