CVE-2026-20970: High severity Samsung SLocation vulnerability
Published Jan 9, 2026
·Updated
Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.
Affected Software
17 affected components
Samsung SLocation<SMR Jan-2026 Release 1
Samsung Android=15.0-smr-apr-2025-r1
Samsung Android=15.0-smr-aug-2025-r1
Samsung Android=15.0-smr-dec-2025-r1
Samsung Android=15.0-smr-feb-2025-r1
Samsung Android=15.0-smr-jul-2025-r1
Samsung Android=15.0-smr-jun-2025-r1
Samsung Android=15.0-smr-mar-2025-r1
Samsung Android=15.0-smr-may-2025-r1
Samsung Android=15.0-smr-nov-2025-r1
Samsung Android=15.0-smr-oct-2025-r1
Samsung Android=15.0-smr-sep-2025-r1
Samsung Android=16.0-smr-aug-2025-r1
Samsung Android=16.0-smr-dec-2025-r1
Samsung Android=16.0-smr-nov-2025-r1
Samsung Android=16.0-smr-oct-2025-r1
Samsung Android=16.0-smr-sep-2025-r1
Event History
Jan 9, 2026
CVE Published
via MITRE·06:16 AM
Data Sourced
via MITRE·06:16 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityAffected Software
Oct 21, 58013
Event
via FIRST·01:48 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-20970?
The severity of CVE-2026-20970 has not been explicitly rated, but it involves improper access control, indicating a significant risk.
2
How do I fix CVE-2026-20970?
To fix CVE-2026-20970, update to SMR Jan-2026 Release 1 or later for Samsung SLocation.
3
Who is affected by CVE-2026-20970?
CVE-2026-20970 affects users of Samsung SLocation versions prior to SMR Jan-2026 Release 1.
4
What type of vulnerability is CVE-2026-20970?
CVE-2026-20970 is classified as an improper access control vulnerability.
5
Can local attackers exploit CVE-2026-20970?
Yes, local attackers can exploit CVE-2026-20970 to execute privileged APIs due to improper access controls.