close

Samsung Mobile Security and Cookies

Our site uses essential cookies only. You can read our Privacy Policy and Cookie Policy for more information.

close

Samsung Mobile Security
Cookie Policy

Updated on Jan 17, 2022

This Cookie Policy describes the different types of cookies that may be used in connection with Samsung Mobile Security website which is owned and controlled by Samsung Electronics Co., Ltd (“Samsung Electronics”). This Cookie Policy also describes how you can manage cookies.

It’s important that you check back often for updates to the Policy as we may change it from time to time to reflect changes to our use of cookies. Please check the date at the top of this page to see when this Policy was last revised. Any changes to this Policy will become effective when we make the revised Policy available on our website.

Samsung Electronics has offices across Europe, so we can ensure that your request or query will be handled by the data protection team based in your region. If you have any questions, the easiest way to contact us is through our Privacy Support Page at https://www.samsung.com/request-desk.

You can also contact us at:

European Data Protection Officer
Samsung Electronics (UK) Limited
Samsung House, 2000 Hillswood Drive, Chertsey, Surrey KT16 0RS

Cookies

Cookies are small files that store information on your computer, TV, mobile phone, or other device. They enable the entity that put the cookie on your device to recognize you across different websites, services, devices, and/or browsing sessions.

We use the following types of cookies on this website:

Essential Cookies: enable you to receive the services you request via our website. Without these cookies, services that you have asked for cannot be provided. For example, these enable to identify users and provide proper service for each user. These cookies are automatically enabled and cannot be turned off because they are essential to enable you to browse our website. Without these cookies this Samsung Mobile Security website could not be provided.

Cookie Domain Purpose
JSESSIONID security.samsungmobile.com to keep login session
lastActivityTime security.samsungmobile.com to save the user's last activity time to automatically logout after 30 minutes of inactivity

Managing Cookies and Other Technologies

You can also update your browser settings at any time, if you want to remove or block cookies from your device (consult your browser's "help" menu to learn how to remove or block cookies). Samsung Electronics is not responsible for your browser settings. You can find good and simple instructions on how to manage cookies on the different types of web browsers at http://www.allaboutcookies.org.

Go straight to the menu Go straight to the text
Home>Security Updates>Firmware Updates

Security Updates

2026Open selected window by year

Close selected window by year
January February March April May June July August September

Disclaimer

  • Please note that in some cases regular OS upgrades may cause delays to planned security updates. However, users can be rest assured the OS upgrades will include up-to-date security patches when delivered.
  • While we are doing our best to deliver the security patches as soon as possible to all applicable models, delivery time of security patches may vary depending on the regions and models.
  • Some patches to be received from chipset vendors (also known as Device Specific patches) may not be included in the security update package of the month. They will be included in upcoming security update packages as soon as the patches are ready to deliver.

Acknowledgements

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - September 2026 Package.

Critical
CVE-2026-20499, CVE-2026-28604, CVE-2026-28666, CVE-2026-49918, CVE-2026-49919, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-52993, CVE-2026-55256, CVE-2026-55273, CVE-2026-55277, CVE-2026-58820, CVE-2026-58823, CVE-2026-58846, CVE-2026-58848, CVE-2026-58941

High
CVE-2026-5729, CVE-2026-7476, CVE-2026-7477, CVE-2026-12285, CVE-2026-12387, CVE-2026-20501, CVE-2026-20502, CVE-2026-20503, CVE-2026-24088, CVE-2026-25275, CVE-2026-28572, CVE-2026-28581, CVE-2026-28605, CVE-2026-28607, CVE-2026-28609, CVE-2026-28616, CVE-2026-28617, CVE-2026-28622, CVE-2026-28627, CVE-2026-28636, CVE-2026-28656(A-463364901, A-520523670), CVE-2026-28664, CVE-2026-28668, CVE-2026-28671, CVE-2026-43049, CVE-2026-45517, CVE-2026-45519, CVE-2026-45525, CVE-2026-45527, CVE-2026-45529, CVE-2026-49881, CVE-2026-49883, CVE-2026-49887, CVE-2026-49895, CVE-2026-49913, CVE-2026-55290, CVE-2026-55294, CVE-2026-58822, CVE-2026-58839, CVE-2026-58874

Moderate
None

Already included in previous updates
CVE-2026-20504

Not applicable to Samsung devices
CVE-2025-48651, CVE-2026-4967, CVE-2026-7639, CVE-2026-20500, CVE-2026-21548, CVE-2026-21549, CVE-2026-21550, CVE-2026-21551, CVE-2026-21552, CVE-2026-21553, CVE-2026-21732, CVE-2026-21733, CVE-2026-22164, CVE-2026-22166, CVE-2026-24092, CVE-2026-25294, CVE-2026-28593, CVE-2026-28613, CVE-2026-28626, CVE-2026-31629, CVE-2026-34192, CVE-2026-34193, CVE-2026-34194, CVE-2026-34195, CVE-2026-34196, CVE-2026-41156, CVE-2026-41157, CVE-2026-41158, CVE-2026-45195, CVE-2026-45196, CVE-2026-45197, CVE-2026-45198, CVE-2026-45200, CVE-2026-45202, CVE-2026-45203, CVE-2026-49743, CVE-2026-49744, CVE-2026-49745, CVE-2026-49746, CVE-2026-55285


※ Please see Android Security Bulletin for detailed information on Google patches.


Samsung Semiconductor patch is also included in this Security Maintenance Release for the following CVEs:

High
CVE-2026-48173

※ Please see Samsung Semiconductor Product Security Update for detailed information on Samsung Semiconductor patches.


Along with Google patches and Samsung Semiconductor patches, Samsung Mobile provides 31 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Sep-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


Critical

SVE-2026-3247(CVE-2026-21095)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
The patch adds proper input validation.

SVE-2026-3282(CVE-2026-21096)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
The patch fixed the incorrect implementation.


High

SVE-2026-1849(CVE-2026-21087)
Affected versions: Android 15, 16, 17
Disclosure status: Privately disclosed
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
The patch adds proper input validation.

SVE-2026-3217(CVE-2026-21094)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-3314(CVE-2026-21104)
Affected versions: Android 15, 16, 17
Disclosure status: Privately disclosed
Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.
The patch adds proper input validation.


Moderate

SVE-2026-0168(CVE-2026-21098)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction.
The patch adds proper access control.

SVE-2026-0828(CVE-2026-21085)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
The patch removes unsafe implementation.

SVE-2026-0885(CVE-2026-21103)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.
The patch adds proper input validation.

SVE-2026-1476(CVE-2026-21099)
Affected versions: Android 15, 16, 17
Disclosure status: Privately disclosed
Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper access control.

SVE-2026-1660(CVE-2026-21086)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper authorization in ProxyHandler prior to SMR Sep-2026 Release 1 allows local attackers to access proxy configuration.
The patch adds proper access control.

SVE-2026-1870(CVE-2026-21088)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper validation logic.

SVE-2026-1878(CVE-2026-21089)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper validation logic.

SVE-2026-1989(CVE-2026-21090)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper validation logic.

SVE-2026-2066(CVE-2026-21091)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper validation logic.

SVE-2026-2233(CVE-2026-21092)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.
The patch adds proper validation logic.

SVE-2026-2314(CVE-2026-21100)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.
The patch adds proper access control.

SVE-2026-2461(CVE-2026-21101)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege.
The patch adds proper validation logic.

SVE-2026-2687(CVE-2026-21093)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-3092(CVE-2026-21102)
Affected versions: Android 14, 15, 16, 17
Disclosure status: Privately disclosed
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
The patch adds proper validation logic.

SVE-2026-3462(CVE-2026-21097)
Affected versions: Android 14,15,16,17
Disclosure status: Privately disclosed
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity.
The patch adds proper authentication.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
Brendon Tiszka and Mateusz Jurczyk of Google Project Zero: SVE-2026-3247, SVE-2026-3282
Andrew Boni: SVE-2026-3217
k4lizen: SVE-2026-3314
011100101001: SVE-2026-0168
Aleksandr Tarasikov: SVE-2026-0828
Sh1fter: SVE-2026-0885
Ye Zhang (@VAR10CK) of Baidu Security: SVE-2026-1870, SVE-2026-1878, SVE-2026-2066
Fábio Luís / @scanpt: SVE-2026-2233
开源三星实力代购: SVE-2026-2314
Lukas Maar: SVE-2026-2461, SVE-2026-3092
Anton Pakhunov: SVE-2026-2687
Know: SVE-2026-3462

Version
VersionDateNotes
1.0Sep 8, 2026Bulletin published

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - August 2026 Package.

Critical
CVE-2026-25289, CVE-2026-28591, CVE-2026-28653, CVE-2026-28662, CVE-2026-45515, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884

High
CVE-2025-22442, CVE-2026-0022, CVE-2026-20473, CVE-2026-20474, CVE-2026-20475, CVE-2026-20477, CVE-2026-20479, CVE-2026-20481, CVE-2026-20497, CVE-2026-24084, CVE-2026-28611, CVE-2026-28620, CVE-2026-28645, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28665, CVE-2026-28667, CVE-2026-45513, CVE-2026-45518, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45528, CVE-2026-45529, CVE-2026-49880, CVE-2026-49885

Moderate
None

Already included in previous updates
CVE-2026-0054

Not applicable to Samsung devices
CVE-2026-20464, CVE-2026-20467, CVE-2026-20468, CVE-2026-20469, CVE-2026-24079, CVE-2026-24080, CVE-2026-25288, CVE-2026-45531


※ Please see Android Security Bulletin for detailed information on Google patches.


Along with Google patches, Samsung Mobile provides 18 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Aug-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2026-1829(CVE-2026-21064)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.
The patch adds proper access control checks.

SVE-2026-1946(CVE-2026-21073)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
The patch adds proper input validation.


Moderate

SVE-2025-2363(CVE-2026-21058)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
The patch adds proper input validation.

SVE-2025-2364(CVE-2026-21059)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
The patch adds proper access control.

SVE-2025-2365(CVE-2026-21060)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.
The patch adds proper input validation.

SVE-2025-2545(CVE-2026-21061)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related function. User interaction is required for triggering this vulnerability.
The patch removes unnecessary implementation.

SVE-2026-0615(CVE-2026-21069)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-0870(CVE-2026-21070)
Affected versions: Android 14, 15
Disclosure status: Privately disclosed
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.
The patch adds proper input validation.

SVE-2026-0916(CVE-2026-21062)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.
The patch adds proper authorization.

SVE-2026-1053(CVE-2026-21071)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-1498(CVE-2026-21063)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.
The patch adds proper access control.

SVE-2026-1813(CVE-2026-21072)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-2065(CVE-2026-21065)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper validation logic.

SVE-2026-2068(CVE-2026-21066)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-2135(CVE-2026-21067)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-2525(CVE-2026-21068)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.
The patch adds proper input validation.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
develicit: SVE-2026-1829
Dawuge of Shuffle Team: SVE-2025-2363, SVE-2025-2364, SVE-2025-2365
Chen Jiang of vivo kM1rr0rs secLab: SVE-2025-2545
suhyeon.jin: SVE-2026-0615
Bob Lam: SVE-2026-0870
Tianyi Hu: SVE-2026-0916
Viktor Babkov: SVE-2026-1053
moyu: SVE-2026-1498
Ye Zhang (@VAR10CK) of Baidu Security: SVE-2026-1813, SVE-2026-2065, SVE-2026-2068
Calif.io in collaboration with Claude and Anthropic Research: SVE-2026-2135
YeonghyeonChoi: SVE-2026-2525

Version
VersionDateNotes
1.0Aug 4, 2026Bulletin published
1.1Aug 10, 2026CVE List updated
1.2Aug 14, 2026CVE List updated

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - July 2026 Package.

Critical
CVE-2026-27280, CVE-2026-28590, CVE-2026-28618, CVE-2026-28639, CVE-2026-33636

High
CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0001, CVE-2026-0010, CVE-2026-0065, CVE-2026-0084, CVE-2026-21383, CVE-2026-24081, CVE-2026-24087, CVE-2026-28582, CVE-2026-28583, CVE-2026-28584, CVE-2026-28585, CVE-2026-28594, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28612, CVE-2026-28614, CVE-2026-28623, CVE-2026-28624, CVE-2026-28630, CVE-2026-28631, CVE-2026-28632, CVE-2026-28633, CVE-2026-28634, CVE-2026-28638, CVE-2026-28642, CVE-2026-28644, CVE-2026-28649, CVE-2026-28650

Moderate
None

Already included in previous updates
CVE-2026-0008, CVE-2026-20461, CVE-2026-24090

Not applicable to Samsung devices
CVE-2026-20457, CVE-2026-20458, CVE-2026-20459, CVE-2026-20460, CVE-2026-21734, CVE-2026-24091, CVE-2026-25259, CVE-2026-25260


※ Please see Android Security Bulletin for detailed information on Google patches.


Along with Google patches, Samsung Mobile provides 16 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Jul-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


Critical

SVE-2026-0716(CVE-2026-21042)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.
The patch adds proper input validation.


High

SVE-2026-1029(CVE-2026-21044)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
The patch adds proper authorization.

SVE-2026-1087(CVE-2026-21045)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-1141(CVE-2026-21046)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code.
The patch adds proper validation logic.

SVE-2026-1354(CVE-2026-21047)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.
The patch adds proper validation logic.

SVE-2026-1650(CVE-2026-21048)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.
The patch adds proper input validation.

SVE-2026-1820(CVE-2026-21049)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.
The patch fixes incorrect implementation.


Moderate

SVE-2025-2635(CVE-2026-21039)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.
The patch adds proper access control.

SVE-2026-0002(CVE-2026-21040)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.
The patch adds proper access control.

SVE-2026-0050(CVE-2026-21050)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper caller check logic.

SVE-2026-0255(CVE-2026-21041)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper access control.

SVE-2026-0379(CVE-2026-21051)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.
The patch adds proper access control.

SVE-2026-1009(CVE-2026-21043)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege.
The patch adds proper input validation.

SVE-2026-1767(CVE-2026-21052)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.
The patch adds proper input validation.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
Chen Jiang of vivo kM1rr0rs secLab: SVE-2026-1029
Dvir Gozlan working with TrendAI Zero Day Initiative: SVE-2026-1087
Xu Yiwen: SVE-2026-1141
Daniel Kaye Inversus Labs: SVE-2026-1354
Hyunwoo Kim (@v4bel): SVE-2026-1650, SVE-2026-1820
Stealth Assassin: SVE-2025-2635
fxffffff: SVE-2026-0002
X0ev: SVE-2026-0050
Eunkyu Lee @ KAIST Hacking Lab.: SVE-2026-1767

Version
VersionDateNotes
1.0Jul 7, 2026Bulletin published
1.1Jul 14, 2026CVE List updated
1.2Jul 21, 2026SVE List updated
1.3Sep 8, 2026SVE List updated

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - June 2026 Package.

Critical
CVE-2026-0097, CVE-2026-21352, CVE-2026-21353, CVE-2026-25276, CVE-2026-25277

High
CVE-2025-26418, CVE-2025-40214, CVE-2025-48612, CVE-2025-48648, CVE-2025-59605, CVE-2025-59606, CVE-2026-0009, CVE-2026-0054, CVE-2026-0060, CVE-2026-0091, CVE-2026-0093, CVE-2026-0094, CVE-2026-0095, CVE-2026-0096, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-20435, CVE-2026-20453, CVE-2026-20454, CVE-2026-20455, CVE-2026-28573, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578, CVE-2026-28580, CVE-2026-28586

Moderate
None

Already included in previous updates
CVE-2025-48581

Not applicable to Samsung devices
CVE-2025-59604, CVE-2025-71251, CVE-2025-71252, CVE-2025-71253, CVE-2025-71254, CVE-2025-71255, CVE-2025-71256, CVE-2026-21538, CVE-2026-21539, CVE-2026-21540, CVE-2026-21541, CVE-2026-21542, CVE-2026-21543, CVE-2026-21544, CVE-2026-21545, CVE-2026-21546, CVE-2026-21547, CVE-2026-21736, CVE-2026-22163, CVE-2026-22167


※ Please see Android Security Bulletin for detailed information on Google patches.


Samsung Semiconductor patch is also included in this Security Maintenance Release for the following CVEs:

High
CVE-2026-23787

※ Please see Samsung Semiconductor Product Security Update for detailed information on Samsung Semiconductor patches.


Along with Google patches and Samsung Semiconductor patches, Samsung Mobile provides 11 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Jun-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2026-0616(CVE-2026-21031)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.
The patch removes unnecessary implementation.


Moderate

SVE-2025-2747(CVE-2026-21025)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper validation logic.

SVE-2026-0054(CVE-2026-21026)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.
The patch adds proper access control.

SVE-2026-0254(CVE-2026-21017)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.
The patch adds proper validation.

SVE-2026-0267(CVE-2026-21029)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.
The patch adds proper access control.

SVE-2026-0428(CVE-2026-21030)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
The patch adds proper access control.

SVE-2026-1316(CVE-2026-21027)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.
The patch adds proper permission.

SVE-2026-1491(CVE-2026-21028)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper validation.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
Sergey Toshin of Oversecured: SVE-2026-0616
Tron: SVE-2025-2747
X0ev: SVE-2026-0054
Yair Hamo: SVE-2026-0428
VM Research: SVE-2026-1316

Version
VersionDateNotes
1.0Jun 2, 2026Bulletin published
1.1Jul 29, 2026CVE List updated

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - May 2026 Package.

Critical
CVE-2026-0051, CVE-2026-0073

High
CVE-2025-32348, CVE-2025-47401, CVE-2025-47403, CVE-2025-48570, CVE-2025-48615, CVE-2025-48652, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0069, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0077, CVE-2026-0078, CVE-2026-0085, CVE-2026-0086, CVE-2026-0087, CVE-2026-0088, CVE-2026-0089, CVE-2026-20447, CVE-2026-20448, CVE-2026-20449, CVE-2026-20450, CVE-2026-24085

Moderate
None

Already included in previous updates
CVE-2025-48605

Not applicable to Samsung devices
CVE-2026-24089


※ Please see Android Security Bulletin for detailed information on Google patches.


Along with Google patches, Samsung Mobile provides 10 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR May-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2026-0483(CVE-2026-21019)
Affected versions: Android Watch 14, 16
Disclosure status: Privately disclosed
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
The patch adds proper check logic.


Moderate

SVE-2025-2186(CVE-2026-21021)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
The patch adds proper check logic.

SVE-2026-0086(CVE-2026-21015)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
The patch adds proper access control.

SVE-2026-0230(CVE-2026-21016)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper validation logic.

SVE-2026-0252(CVE-2026-21022)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
The patch adds proper check logic.

SVE-2026-0478(CVE-2026-21018)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
The patch adds proper input validation.

SVE-2026-0623(CVE-2026-21020)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
The patch adds proper permission.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
X0evev: SVE-2026-0483
Reza Feizi: SVE-2025-2186
X0ev: SVE-2026-0086
Chen Jiang of vivo kM1rr0rs secLab: SVE-2026-0230
Rayyan Kadar: SVE-2026-0623

Version
VersionDateNotes
1.0May 6, 2026Bulletin published

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - April 2026 Package.

Critical
CVE-2023-20713, CVE-2025-47392, CVE-2025-64505, CVE-2025-64720, CVE-2025-65018, CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0080

High
CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48651(A-467762899), CVE-2026-0016, CVE-2026-0018, CVE-2026-0036, CVE-2026-0045, CVE-2026-0046, CVE-2026-0048, CVE-2026-0050, CVE-2026-0055, CVE-2026-0056, CVE-2026-0058, CVE-2026-0059, CVE-2026-0067, CVE-2026-0079, CVE-2026-21381

Moderate
CVE-2026-20435

Already included in previous updates
CVE-2025-47384, CVE-2025-48595, CVE-2025-48616, CVE-2025-48649, CVE-2026-20431, CVE-2026-20433

Not applicable to Samsung devices
CVE-2025-47400, CVE-2025-48651(A-434039170, A-467765081, A-467765894), CVE-2026-20432, CVE-2026-21367, CVE-2026-21372, CVE-2026-21373, CVE-2026-21374, CVE-2026-21375, CVE-2026-21376, CVE-2026-21378, CVE-2026-21380


※ Please see Android Security Bulletin for detailed information on Google patches.


Samsung Semiconductor patch is also included in this Security Maintenance Release for the following CVEs:

High
CVE-2025-52908, CVE-2025-52909, CVE-2025-54601, CVE-2025-54602

※ Please see Samsung Semiconductor Product Security Update for detailed information on Samsung Semiconductor patches.


Along with Google patches and Samsung Semiconductor patches, Samsung Mobile provides 9 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Apr-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2025-2188(CVE-2026-21007)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.
The patch adds proper check logic.

SVE-2025-2589(CVE-2026-21010)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
The patch removes unnecessary implementation.


Moderate

SVE-2025-1863(CVE-2026-21006)
Affected versions: Android 15
Disclosure status: Privately disclosed
Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.
The patch adds proper status check.

SVE-2025-2300(CVE-2026-21008)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.
The patch removes exposure of sensitive information.

SVE-2025-2443(CVE-2026-21009)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.
The patch adds proper input validation.

SVE-2026-0025(CVE-2026-21012)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege.
The patch adds proper input validation.

SVE-2026-0102(CVE-2026-21011)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock.
The patch adds proper privilege assignment.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
Vladyslav Kravchenko: SVE-2025-1863
刘晓峰: SVE-2025-2300
Andr.Ess: SVE-2025-2443
VIGNESH.K.G: SVE-2026-0025
localh0ster: SVE-2026-0102

Version
VersionDateNotes
1.0Apr 7, 2026Bulletin published
1.1May 11, 2026SVE List updated

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - March 2026 Package.

Critical
CVE-2026-0006, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031, CVE-2026-0037, CVE-2026-0038, CVE-2026-0047

High
CVE-2024-31328, CVE-2025-10865, CVE-2025-13952, CVE-2025-2879, CVE-2025-32313, CVE-2025-38616, CVE-2025-38618, CVE-2025-39682, CVE-2025-39946(A-432728472), CVE-2025-39946(A-446648770), CVE-2025-40266, CVE-2025-47384, CVE-2025-47385, CVE-2025-48544, CVE-2025-48567, CVE-2025-48578, CVE-2025-48579, CVE-2025-48582, CVE-2025-48585, CVE-2025-48587, CVE-2025-48615, CVE-2025-48634, CVE-2025-48636, CVE-2025-48642, CVE-2025-48644, CVE-2025-48653, CVE-2025-48654, CVE-2025-58407, CVE-2025-58408, CVE-2025-58409, CVE-2025-58411, CVE-2025-59600, CVE-2025-64783, CVE-2025-64784, CVE-2025-64893, CVE-2026-0005, CVE-2026-0011, CVE-2026-0012, CVE-2026-0013, CVE-2026-0024, CVE-2026-0025, CVE-2026-0029, CVE-2026-0032, CVE-2026-0034, CVE-2026-0035, CVE-2026-20425, CVE-2026-20426, CVE-2026-20427, CVE-2026-20428, CVE-2026-20434, CVE-2026-21385

Already included in previous updates
CVE-2025-47378, CVE-2025-48631, CVE-2026-0026

Not applicable to Samsung devices
CVE-2025-48613, CVE-2025-61612, CVE-2025-61613, CVE-2025-61614, CVE-2025-61615, CVE-2025-61616, CVE-2025-69278, CVE-2025-69279


※ Please see Android Security Bulletin for detailed information on Google patches.


Along with Google patches, Samsung Mobile provides 8 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Mar-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2025-1906(CVE-2026-20988)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.
The patch adds proper access control.

SVE-2025-2310(CVE-2026-20990)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege.
The patch adds proper permission.


Moderate

SVE-2025-1926(CVE-2026-20989)
Affected versions: Android 16
Disclosure status: Privately disclosed
Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.
The patch adds proper verification.

SVE-2025-2520(CVE-2026-20991)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.
The patch adds proper validation logic.

SVE-2025-2847(CVE-2026-20992)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
The patch adds proper authorization.

SVE-2026-0023(CVE-2026-21023)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.
The patch adds proper verification logic.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
moyu: SVE-2025-1906
Dawuge of Shuffle Team and Hunan University: SVE-2025-2310
Rajesh: SVE-2025-2520
Tron: SVE-2025-2847
VIGNESH.K.G: SVE-2026-0023

Version
VersionDateNotes
1.0March 3, 2026Bulletin published
1.1April 2, 2026CVE List updated
1.2April 29, 2026SVE List updated

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - February 2026 Package.

Critical
None

High
CVE-2025-47366, CVE-2025-47397, CVE-2025-47398, CVE-2025-47402, CVE-2025-48630, CVE-2025-48641, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48650, CVE-2026-0014, CVE-2026-0015, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0023, CVE-2026-20401, CVE-2026-20403, CVE-2026-20404, CVE-2026-20405, CVE-2026-20406, CVE-2026-20420, CVE-2026-20421, CVE-2026-20422

Moderate
None

Already included in previous updates
CVE-2025-48568, CVE-2025-48574, CVE-2025-48577, CVE-2025-48602, CVE-2025-48605, CVE-2025-48616, CVE-2025-48619, CVE-2026-20402


※ Please see Android Security Bulletin for detailed information on Google patches.


Along with Google patches, Samsung Mobile provides 12 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Feb-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2025-1140(CVE-2026-20977)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.
The patch adds proper access control.

SVE-2025-1217(CVE-2026-20983)
Affected versions: Android 14, 15
Disclosure status: Privately disclosed
Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.
The patch adds proper access control.

SVE-2025-2226(CVE-2026-20978)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
The patch adds proper authorization.

SVE-2025-2289(CVE-2026-20979)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.
The patch removes improper implementation.

SVE-2025-2473(CVE-2026-20980)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.
The patch modifies the authentication logic.


Moderate

SVE-2025-2705(CVE-2026-20981)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege.
The patch removes unused code.

SVE-2025-2706(CVE-2026-20982)
Affected versions: Android 14, 15, 16
Disclosure status: Privately disclosed
Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.
The patch adds proper input validation.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
localh0ster: SVE-2025-1140
Dzmitry Lukyanenka: SVE-2025-1217
Chen Jiang of vivo kM1rr0rs secLab: SVE-2025-2226
moyu veritas501 and 3ndy1 from Dawn Security Lab of JD.com, Inc: SVE-2025-2289
VIGNESH.K.G: SVE-2025-2473, SVE-2025-2705, SVE-2025-2706

Version
VersionDateNotes
1.0Febrary 3, 2026Bulletin published

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.


Google Patches for the following CVEs from Android Security Bulletin are applied in this Security Maintenance Release - January 2026 Package.

Critical
CVE-2024-43859, CVE-2025-54957

High
CVE-2024-43766, CVE-2025-32348, CVE-2025-48609, CVE-2025-48635, CVE-2026-0007, CVE-2026-0008, CVE-2026-0010, CVE-2026-0011, CVE-2025-20760, CVE-2025-20761, CVE-2025-20762, CVE-2025-20793, CVE-2025-20794, CVE-2025-20795, CVE-2025-47339, CVE-2025-47348, CVE-2025-47388, CVE-2025-47394, CVE-2025-47396

Moderate
None

Already included in previous updates
None

Not applicable to Samsung devices
CVE-2025-47346, CVE-2025-47395


※ Please see Android Security Bulletin for detailed information on Google patches.


Samsung Semiconductor patch is also included in this Security Maintenance Release for the following CVEs:

High
CVE-2025-27807, CVE-2025-49495, CVE-2025-52519, CVE-2025-53966

※ Please see Samsung Semiconductor Product Security Update for detailed information on Samsung Semiconductor patches.


Along with Google patches and Samsung Semiconductor patches, Samsung Mobile provides 30 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Jan-2026 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.


High

SVE-2025-1716(CVE-2026-20969)
Affected versions: Selected Android 13, 14, 15, 16 devices
Disclosure status: Privately disclosed
Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability.
The patch adds proper input validation.

SVE-2025-2103(CVE-2026-20971)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.
The patch removes unused code.

SVE-2025-2316(CVE-2026-20973)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.
The patch adds proper input validation.

SVE-2025-2394(CVE-2026-20974)
Affected versions: Selected Android 13, 14, 15, 16 devices
Disclosure status: Privately disclosed
Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.
The patch adds proper validation logic.


Moderate

SVE-2025-1183(CVE-2026-20968)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.
The patch adds proper check logic.

SVE-2025-1990(CVE-2026-20970)
Affected versions: Android 15, 16
Disclosure status: Privately disclosed
Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.
The patch adds proper access control.

SVE-2025-2255(CVE-2026-20972)
Affected versions: Android 13, 14, 15, 16
Disclosure status: Privately disclosed
Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.
The patch adds proper permission.


Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.


Acknowledgements
Lior Keshet of Lucid Bit Labs: SVE-2025-1183, SVE-2025-2103
Ethan Hunt: SVE-2025-1716
Bob Lam: SVE-2025-1990
Martin Heyden: SVE-2025-2255
Brendon Tiszka and Mateusz Jurczyk of Google Project Zero: SVE-2025-2316

Version
VersionDateNotes
1.0January 6, 2026Bulletin published
1.1January 8, 2026CVE List updated
1.2January 9, 2026SVE List updated