CVE-2026-21067: libsmsd.so Use-After-Free Vulnerability

CVE-2026-21067 Overview

CVE-2026-21067 is an improper input validation vulnerability in libsmsd.so, a shared library used in Samsung Mobile devices. The flaw allows local attackers to write out-of-bounds memory on affected devices. Samsung addressed the issue in the SMR Aug-2026 Release 1 security maintenance update.

The vulnerability requires local access and no user interaction. Successful exploitation can corrupt adjacent memory, leading to application instability or manipulation of process state within the SMS daemon context.

Critical Impact
Local attackers can write out-of-bounds memory in libsmsd.so, potentially corrupting process memory and affecting SMS-related functionality on unpatched Samsung Mobile devices.

Affected Products

Samsung Mobile devices running firmware prior to SMR Aug-2026 Release 1
libsmsd.so shared library component
Samsung Android-based mobile platforms shipped with the vulnerable SMS daemon

Discovery Timeline

2026-08-10 - CVE-2026-21067 published to NVD
2026-08-10 - Last updated in NVD database
SMR Aug-2026 Release 1 - Samsung releases security patch through Samsung Mobile Security update

Technical Details for CVE-2026-21067

Vulnerability Analysis

The vulnerability resides in libsmsd.so, a native library that processes SMS-related data on Samsung Mobile devices. The library fails to properly validate input before performing memory write operations. This allows an attacker with local access to trigger an out-of-bounds write [CWE-787].

Out-of-bounds writes corrupt memory adjacent to the intended buffer. Depending on the affected memory region, the outcome ranges from process crashes to manipulation of control data structures. The advisory classifies the issue as improper input validation, indicating that boundary or type checks are missing or insufficient before the write occurs.

Exploitation does not require authentication or user interaction, but the attacker must already have local execution context on the device. This typically means a malicious application installed on the target device or another local vector that can invoke the vulnerable code path in libsmsd.so.

Root Cause

The root cause is missing or incomplete input validation in libsmsd.so before memory write operations. When untrusted input reaches the vulnerable routine, size or index checks fail to constrain the write within allocated buffer bounds. Samsung's advisory does not publicly disclose the exact function or field involved.

Attack Vector

A local attacker delivers crafted input to the SMS daemon through an inter-process channel or API exposed to on-device applications. The vulnerable code path in libsmsd.so processes the input without adequate validation and performs an out-of-bounds write. Refer to the Samsung Mobile Security Update for vendor-supplied technical context.

Detection Methods for CVE-2026-21067

Indicators of Compromise

Unexpected crashes or restarts of SMS-related system processes referencing libsmsd.so
Anomalous native crash reports (tombstones) containing libsmsd.so in the backtrace
Installation of untrusted applications requesting SMS-related permissions prior to daemon instability

Detection Strategies

Monitor Android system logs (logcat) and tombstone files for SIGSEGV or SIGABRT signals originating in libsmsd.so
Inventory Samsung Mobile devices and compare firmware build dates against SMR Aug-2026 Release 1
Correlate crash telemetry with recently installed applications to identify potential local exploitation attempts

Monitoring Recommendations

Enroll Samsung Mobile devices in mobile device management (MDM) and enforce security patch level reporting
Alert on devices reporting security patch levels older than the August 2026 release
Review application install events on managed devices for unauthorized sideloading

How to Mitigate CVE-2026-21067

Immediate Actions Required

Apply the Samsung SMR Aug-2026 Release 1 update to all affected Samsung Mobile devices
Identify unpatched devices through MDM and prioritize remediation on devices with sideloaded applications
Restrict installation of applications from untrusted sources until patches are applied

Patch Information

Samsung addressed CVE-2026-21067 in the SMR Aug-2026 Release 1 security maintenance update. Details are available in the Samsung Mobile Security Update advisory for August 2026. Users should install the update via Settings > Software update on their device.

Workarounds

Disable installation of applications from unknown sources in device settings
Limit local access to devices and enforce screen-lock policies through MDM
Remove untrusted third-party applications that request SMS-related permissions until the patch is applied

bash

# Verify Samsung security patch level meets or exceeds August 2026
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-08-01 or later