{"id":"CVE-2026-21157","aliases":[],"cve":{"records":[{"id":"CVE-2026-21157","source":"SamsungMobile","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-12-11T01:33:35.837Z","published":"2026-10-29T01:01:58.516Z","modified":"2026-10-30T03:55:58.739Z"}],"publishers":[{"name":"SamsungMobile","role":"CNA","organizationId":"3af57064-a867-422c-b2ad-40307b65c458","modified":"2026-10-29T01:01:58.516Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T03:55:58.739Z"}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07","tags":[],"source":"SamsungMobile"}],"weaknesses":[{"id":"CWE-20","description":"CWE-20 Improper Input Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.","titleSource":"SamsungMobile","descriptionSource":"SamsungMobile","description":"Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.","score":8.3,"severity":"high","published":"2026-10-29T01:01:58.516Z","modified":"2026-10-30T03:55:58.739Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Samsung Mobile","name":"Bixby","platforms":[],"versions":[{"version":"4.0.85.6","status":"unaffected","lessThan":"*","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"SamsungMobile","url":"https://www.cve.org/CVERecord?id=CVE-2026-21157"}],"remediation":[],"references":["https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07"],"sources":[{"name":"CVE","id":"CVE-2026-21157","modified":"2026-10-30T03:55:58.739Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-21157"}],"assessments":[{"source":"SamsungMobile","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.3}],"sourceAffected":[],"observedAt":"2026-10-30T04:20:29.061Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T10:45:31.243Z","attemptedAt":"2026-10-29T10:45:31.243Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T10:45:31.243Z","attemptedAt":"2026-10-29T10:45:31.243Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T10:45:31.243Z","attemptedAt":"2026-10-29T10:45:31.243Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T10:45:31.243Z","attemptedAt":"2026-10-29T10:45:31.243Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-112562","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112562","modified":"Oct 29, 2026, 1:01:58 AM","score":8.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-29T10:45:31.243Z"},{"source":"NVD","id":"CVE-2026-21157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21157","modified":"2026-10-29T01:17:23.187","score":8.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T10:45:31.243Z"},{"source":"GitHub Advisory Database","id":"GHSA-pw33-6fpc-cwfm","url":"https://github.com/advisories/GHSA-pw33-6fpc-cwfm","modified":"2026-10-29T03:30:28Z","checkedAt":"2026-10-29T10:45:31.243Z"}],"aiSummary":{"text":"Bixby versions prior to 4.0.85.6 have an improper input validation weakness, allowing privileged local attackers to launch arbitrary activity. The vulnerability requires local access. The impact is launching arbitrary activity.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:12:03.102Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-21157"}]}}