Description
Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.
Published: 2026-02-04
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

Improper privilege management in the Settings application on Samsung Android devices before the February 2026 Release 1 allows local attackers to launch arbitrary activities using the elevated Settings privilege. This flaw can lead to execution of privileged code or configuration changes without the user’s consent, thereby compromising system integrity and potentially enabling further privilege escalation or unauthorized data access.

Affected Systems

Samsung Android 15.0 and 16.0 devices receiving firmware before SMR Feb-2026 Release 1 are affected. The issue is present across a range of SMR delivery releases such as smr-jan-2025-r1, smr-feb-2025-r1, smr-jan-2026-r1 and numerous other monthly and yearly updates across both Android 15 and 16 lines.

Risk and Exploitability

The vulnerability has a CVSS score of 8.4, indicating high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. Nonetheless, a local adversary with access to the device can exploit the flaw. Attack feasibility is straightforward as it requires only local interaction and the firmware preceding the February 2026 update.

Generated by OpenCVE AI on April 18, 2026 at 14:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Samsung Android security update that includes the Settings privilege fix.
  • Restrict or disable the Settings application for standard users to prevent local privilege misuse.
  • Monitor device logs for unusual activity and apply additional device management controls such as locked‑down profiles.

Generated by OpenCVE AI on April 18, 2026 at 14:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Improper Settings Activity Launch in Samsung Android

Thu, 05 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Samsung android
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:samsung:android:15.0:-:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-apr-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-aug-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-dec-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-feb-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-jan-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-jan-2026-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-jul-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-jun-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-mar-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-may-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-nov-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-oct-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:15.0:smr-sep-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-aug-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-dec-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-jan-2026-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-nov-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-oct-2025-r1:*:*:*:*:*:*
cpe:2.3:o:samsung:android:16.0:smr-sep-2025-r1:*:*:*:*:*:*
Vendors & Products Samsung android
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 04 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Samsung
Samsung samsung Mobile
Vendors & Products Samsung
Samsung samsung Mobile

Wed, 04 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 04 Feb 2026 06:45:00 +0000

Type Values Removed Values Added
Description Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Samsung Android Samsung Mobile
cve-icon MITRE

Status: PUBLISHED

Assigner: SamsungMobile

Published:

Updated: 2026-02-26T15:04:21.706Z

Reserved: 2025-12-11T01:33:35.799Z

Link: CVE-2026-20979

cve-icon Vulnrichment

Updated: 2026-02-04T16:55:39.580Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-04T07:15:59.840

Modified: 2026-02-05T21:15:46.767

Link: CVE-2026-20979

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T14:15:04Z

Weaknesses