CVE-2026-21113 Overview
CVE-2026-21113 is a medium-severity vulnerability in Samsung's Visual Voicemail application for Android. The flaw stems from improper export of application components, allowing a local attacker to initiate phone calls without holding the required permission. Samsung addressed the issue in Visual Voicemail version 20.1.00.05 as part of the September 2026 security maintenance release. The weakness is classified under [CWE-926: Improper Export of Android Application Components].
Critical Impact
A locally installed malicious application can trigger outbound calls through Visual Voicemail without requesting CALL_PHONE or related permissions, enabling toll fraud and unauthorized dialing.
Affected Products
- Samsung Visual Voicemail prior to version 20.1.00.05
- Android devices with the Samsung Visual Voicemail application installed
- Samsung Galaxy devices receiving the September 2026 Samsung Mobile Security update
Discovery Timeline
- 2026-09-09 - CVE-2026-21113 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-21113
Vulnerability Analysis
The Samsung Visual Voicemail application exposes one or more Android components (activity, service, receiver, or provider) with an exported=true attribute or an implicit intent filter. These components accept intents from any application on the device without enforcing caller permission checks. An unprivileged local app can craft an intent that reaches the exposed component and instructs Visual Voicemail to initiate a call. Because Visual Voicemail itself holds telephony permissions, the underlying dialer action executes with those privileges, bypassing the normal Android permission model.
Root Cause
The root cause is a design and configuration flaw in the application's manifest and component boundary. Components handling call-initiation logic are reachable by external callers, and the receiving code does not verify the sender's identity or permission set. Under Android's permission model, sensitive actions such as placing calls require the invoking app to hold android.permission.CALL_PHONE. Delegating that action through an exported component without a caller-side permission check violates least-privilege guarantees, matching the [CWE-926] pattern.
Attack Vector
Exploitation requires local access and low privileges. An attacker installs or convinces the user to install a low-privilege application containing no telephony permissions. That application sends a targeted intent to the vulnerable Visual Voicemail component. Visual Voicemail then places a call to an attacker-chosen number. There is no user interaction required beyond installing the initial app, and the abuse can facilitate toll fraud, premium-rate dialing, or reconnaissance calls. Remote exploitation over a network is not possible; the attacker must have code running on the device.
No public proof-of-concept code has been published. Refer to the Samsung Security Service Update for vendor-provided technical detail.
Detection Methods for CVE-2026-21113
Indicators of Compromise
- Unexpected outbound calls initiated by the com.samsung.vvm process or associated Visual Voicemail package in device call logs.
- Presence of installed applications that send intents targeting Visual Voicemail components without declaring telephony permissions.
- Unexplained charges on mobile bills for premium-rate or international numbers on devices running Visual Voicemail below 20.1.00.05.
Detection Strategies
- Inventory mobile fleet builds and flag devices where the Visual Voicemail package version is earlier than 20.1.00.05.
- Use Mobile Threat Defense (MTD) or Mobile Device Management (MDM) telemetry to identify sideloaded applications requesting broad intent access on Samsung handsets.
- Correlate Android telephony logs with app foreground events to identify calls initiated without a user-driven dialer session.
Monitoring Recommendations
- Monitor enterprise expense-management systems for spikes in outbound call volume to unusual destinations.
- Enable MDM policies that report installed application inventories and version numbers to a central logging platform.
- Alert on newly installed non-store applications on managed Samsung devices, especially those requesting QUERY_ALL_PACKAGES or targeting known vendor components.
How to Mitigate CVE-2026-21113
Immediate Actions Required
- Update Samsung Visual Voicemail to version 20.1.00.05 or later through the Galaxy Store.
- Apply the September 2026 Samsung Mobile security maintenance release to all managed Samsung devices.
- Audit installed applications and remove untrusted or sideloaded apps that could reach exported components.
Patch Information
Samsung released the fix in Visual Voicemail version 20.1.00.05, distributed through the September 2026 Samsung Mobile Security Maintenance Release. Details are available in the Samsung Security Service Update bulletin. Enterprises using MDM should push the update to enrolled devices and verify the installed package version post-deployment.
Workarounds
- Disable or uninstall the Visual Voicemail application on devices that cannot be updated immediately, where operationally acceptable.
- Restrict application installation to vetted enterprise stores via MDM policy to reduce the risk of malicious local apps.
- Enforce a mobile application allowlist and block installation of unknown-source APKs on managed Samsung devices.
# Example: verify installed Visual Voicemail version via ADB
adb shell dumpsys package com.samsung.vvm | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
