VulnerabilityAwaiting Analysis

CVE-2026-21113

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.

MEDIUM 4.8EPSS 0.09%

Does this matter?

Lower severity and a low EPSS score (0.09%). Track it; it rarely justifies an emergency change on its own.

Description

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.

CVSS 4.0: 4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.09% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-926
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=09

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.