Read the docs
TI-2026-70841 Aliases CVE-2026-21119GHSA-pjpr-mc9x-58v2

Out-of-bounds read and write in Samsung lib_sag_ai_sound_sep library

Priority LOW 21Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so in Samsung Mobile Devices prior to SMR Oct-2026 Release 1 lets a local attacker read and write memory outside the intended bounds. The attacker needs local access with low privileges. The flaw can expose or corrupt data and has a low impact on availability in the CVSS vector. The flaw is not listed in CISA KEV and no public exploit is referenced.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Fix Fixed Samsung Mobile Devices (Samsung Mobile): SMR Oct-2026 Release in Selected Android 16, 17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Mobile Devices—SMR Oct-2026 Release in Selected Android 16, 17Patch availableCNA
  • Samsung Mobile Devices VendorSamsung Affected — Fixed in SMR Oct-2026 Release in Selected Android 16, 17 Patch available CNA

Remediation

Samsung Mobile Devices should be updated to the SMR Oct-2026 Release in selected Android 16 and 17 builds. The sources list no fixed version for Samsung Mobile Devices on other Android releases.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Samsung Mobile Devices (Samsung Mobile) Fixed in SMR Oct-2026 Release in Selected Android 16, 17

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-21119
  2. 2026-10-12 Alias added: GHSA-pjpr-mc9x-58v2
  3. 2026-10-16 CISA SSVC decision points changed

References

Other 1

  • TI-2025-15039 Out-of-bounds write in Samsung Mobile Devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-15038 Out-of-bounds write in Samsung Mobile Devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-04133 Path traversal in Samsung MagicINFO 9 Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-06858 Path traversal in Samsung MagicINFO 9 Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-00916 Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before… KEVCVSS 3.1HIGH 8.8
  • TI-2022-06595 An improper check or handling of exceptional conditions in NPU driver prior to SMR… KEVCVSS 3.1HIGH 7.8
See all 2043 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences