CVE-2026-21059: Medium severity Samsung Contacts vulnerability
Published Aug 10, 2026
·Updated
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
Affected Software
14 affected components
Samsung Contacts<SMR Aug-2026 Release 1
Samsung Android=16.0
Samsung Android=16.0-smr-apr-2026-r1
Samsung Android=16.0-smr-aug-2025-r1
Samsung Android=16.0-smr-dec-2025-r1
Samsung Android=16.0-smr-feb-2026-r1
Samsung Android=16.0-smr-jan-2026-r1
Samsung Android=16.0-smr-jul-2026-r1
Samsung Android=16.0-smr-jun-2026-r1
Samsung Android=16.0-smr-mar-2026-r1
Samsung Android=16.0-smr-may-2026-r1
Samsung Android=16.0-smr-nov-2025-r1
Samsung Android=16.0-smr-oct-2025-r1
Samsung Android=16.0-smr-sep-2025-r1
Event History
Aug 10, 2026
CVE Published
via MITRE·07:39 AM
Data Sourced
via MITRE·07:39 AM
DescriptionWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-21059?
CVE-2026-21059 has a risk level of 27, indicating a significant potential for abuse by local attackers.
2
How do I fix CVE-2026-21059?
To resolve CVE-2026-21059, update your Samsung Contacts app to the latest version provided in the August 2026 security release.
3
What issue does CVE-2026-21059 address?
CVE-2026-21059 addresses an improper export of Android application components that allows local attackers to delete files with Samsung Contacts' privileges.
4
Who is affected by CVE-2026-21059?
CVE-2026-21059 affects users of Samsung Contacts prior to the August 2026 security update.
5
Can CVE-2026-21059 be exploited remotely?
CVE-2026-21059 cannot be exploited remotely as it requires local access to the device.