CVE-2026-21112
MEDIUM · CVSS 5.5EPSS 0.1%EU EUVD
Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability.
Key facts
- CVSS score
- 5.5 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Weakness (CWE)
- CWE-20
- EPSS score
- 0.1% (1th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2026-74653)
- Published
- September 9, 2026
- NVD last modified
- September 23, 2026
- Status
- Analyzed
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-74653 in the EU Vulnerability Database. Last updated in EUVD on September 10, 2026.
View on the EU Vulnerability DatabaseAffected products
- samsung / android
Certified products that may be affected
19 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Samsung BoringCrypto Android 15 - Samsung Electronics Co., Ltd. - FIPS 140 5530 - active
- Samsung BoringCrypto Android 14 - Samsung Electronics Co., Ltd. - FIPS 140 5521 - active
- Samsung Electronics Co., Ltd. Samsung Galaxy Devices on Android 16 – Fall - Samsung Electronics Co., Ltd. - Common Criteria CCEVS-VR-VID-11664-2026 - active
- Samsung Electronics Co., Ltd. Samsung Galaxy Devices on Android 15 – Spring - Samsung Electronics Co., Ltd. - Common Criteria CCEVS-VR-VID-11593-2025 - active
- Samsung Galaxy Devices on Android 14 - Fall - Samsung Electronics Co., Ltd. - Common Criteria CCEVS-VR-VID-11539-2024 - active
See all 19 in the Security Certifications Explorer.
References
Last updated September 25, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain