CVE-2026-21047: ImsService RCE Vulnerability

CVE-2026-21047 Overview

CVE-2026-21047 is an out-of-bounds write vulnerability in Samsung's ImsService component, the IP Multimedia Subsystem (IMS) service that handles VoLTE, VoWiFi, and RCS signaling on Samsung mobile devices. The flaw affects Samsung mobile firmware prior to the Samsung Mobile Release (SMR) July 2026 Release 1. Remote attackers can trigger the memory corruption over the network without user interaction or authentication, potentially executing arbitrary code within the context of the ImsService process. The vulnerability is tracked under CWE-787: Out-of-bounds Write.

Critical Impact
Remote code execution in a privileged telephony service reachable over the mobile network, with no authentication or user interaction required.

Affected Products

Samsung mobile devices running firmware prior to SMR Jul-2026 Release 1
Samsung ImsService component handling IMS/VoLTE signaling
Devices with IMS-enabled carrier profiles active on the baseband

Discovery Timeline

2026-07-28 - CVE-2026-21047 published to NVD
2026-07-30 - Last updated in NVD database
July 2026 - Samsung addresses issue in SMR Jul-2026 Release 1 security bulletin

Technical Details for CVE-2026-21047

Vulnerability Analysis

The vulnerability resides in ImsService, the Android system service responsible for parsing and processing IMS control messages. An out-of-bounds write occurs when the service handles a specially crafted message and writes beyond the allocated buffer boundary. The flaw is reachable over the network attack surface, meaning a remote attacker can deliver the malicious payload through IMS signaling channels such as SIP or RCS traffic. Successful exploitation corrupts adjacent memory in the ImsService process, which runs with telephony privileges on the device. The primary security impact is on integrity and availability, while confidentiality is not directly affected according to the CVSS 4.0 vector.

Root Cause

The root cause is missing or insufficient bounds checking when ImsService copies attacker-controlled data from an incoming IMS message into a fixed-size buffer. The parser does not validate the length of the untrusted input against the destination buffer size before writing, allowing adjacent heap or stack memory to be overwritten. This class of defect is catalogued under CWE-787 and frequently enables control-flow hijacking on Android telephony components.

Attack Vector

Exploitation requires network reachability to the target device's IMS stack. An attacker in a position to send IMS or SIP traffic to the victim, such as via a rogue base station, a compromised carrier network, or IMS routing abuse, can send a malformed signaling message. No user interaction is required and the victim receives no prompt. Because ImsService processes signaling before any UI is shown, exploitation is silent from the user's perspective.

No verified public proof-of-concept is available. See the Samsung Mobile Security Update advisory for further technical context.

Detection Methods for CVE-2026-21047

Indicators of Compromise

Unexpected crashes or restarts of the com.samsung.advp.imsservice or ImsService process in logcat and tombstone files
Anomalous inbound SIP or IMS signaling from unfamiliar peers or unusual roaming partners
Device reboots or radio subsystem resets correlated with incoming IMS traffic
Baseband or telephony crash dumps referencing memory corruption in IMS parsing routines

Detection Strategies

Monitor mobile device management (MDM) telemetry for firmware build strings older than SMR Jul-2026 Release 1 across the fleet
Correlate IMS process crashes with signaling logs on carrier or enterprise IMS gateways where visible
Alert on repeated crashes of telephony components on a single device, which can indicate exploit attempts or fuzzing

Monitoring Recommendations

Track Samsung SMR patch level compliance through enterprise MDM inventory reports
Ingest device crash and reliability telemetry into a central analytics pipeline for pattern detection
Review carrier-side IMS logs for malformed SIP messages targeting known Samsung device fingerprints

How to Mitigate CVE-2026-21047

Immediate Actions Required

Apply the SMR Jul-2026 Release 1 security update to all affected Samsung devices through carrier or enterprise MDM channels
Inventory the mobile fleet to identify devices still running firmware below the July 2026 patch level
Prioritize patching for devices used by executives, engineers, or personnel with access to sensitive systems

Patch Information

Samsung addressed the vulnerability in SMR Jul-2026 Release 1. Refer to the Samsung Mobile Security Update bulletin for July 2026 for the list of affected models and the specific firmware build numbers containing the fix.

Workarounds

Disable VoLTE, VoWiFi, and Advanced Calling features on unpatched devices where operationally acceptable, reducing exposure of the IMS parser
Restrict use of unpatched devices to trusted carrier networks and avoid roaming on untrusted networks
Enforce MDM policy blocking activation of devices below the required SMR patch level from accessing corporate resources

bash

# Example MDM compliance check pseudocode
# Flag devices below Samsung SMR Jul-2026 Release 1
if device.vendor == "samsung" and device.security_patch_level < "2026-07-01":
    device.compliance = "non-compliant"
    device.action = "quarantine_and_notify"