CVE-2026-20989: Medium severity Samsung Android vulnerability
Published Mar 16, 2026
·Updated
Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.
Affected Software
8 affected components
Samsung Android=16.0
Samsung Android=16.0-smr-aug-2025-r1
Samsung Android=16.0-smr-dec-2025-r1
Samsung Android=16.0-smr-feb-2026-r1
Samsung Android=16.0-smr-jan-2026-r1
Samsung Android=16.0-smr-nov-2025-r1
Samsung Android=16.0-smr-oct-2025-r1
Samsung Android=16.0-smr-sep-2025-r1
Event History
Mar 16, 2026
CVE Published
via MITRE·04:31 AM
Data Sourced
via MITRE·04:31 AM
DescriptionWeakness
Data Sourced
via NVD·02:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-20989?
CVE-2026-20989 is considered a high severity vulnerability due to its potential exploitation by physical attackers.
2
How do I fix CVE-2026-20989?
To fix CVE-2026-20989, ensure that your device is updated to the latest security patch provided by Samsung.
3
Who is affected by CVE-2026-20989?
CVE-2026-20989 affects devices running Samsung Android version 16.0 prior to SMR Mar-2026 Release 1.
4
What type of attack does CVE-2026-20989 enable?
CVE-2026-20989 allows attackers to exploit improper verification of cryptographic signatures to use custom fonts.
5
Is there a workaround for CVE-2026-20989?
There are no recommended workarounds for CVE-2026-20989; updating the device is the primary solution.