CVE-2026-21092: Path Traversal

Q: Which devices are exposed to this issue?

Devices running ImsService versions prior to the SMR Sep-2026 Release 1 are affected. The provided information does not identify specific device models or Android versions.

Q: What access does an attacker need to exploit it?

The issue is described as remotely exploitable, so the provided data indicates an attacker can attack it remotely. It does not specify any required authentication, user interaction, or network positioning.

Q: What is the potential impact of successful exploitation?

A successful attacker can create image files with system server privilege. The provided information does not state whether this also enables file overwrite, code execution, or data access.

Published Sep 9, 2026

Updated

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.

Affected Software

1 affected component

ImsService<SMR Sep-2026 Release 1

Event History

Sep 9, 2026

CVE Published

via MITRE·04:47 AM

Data Sourced

via MITRE·04:47 AM

DescriptionWeakness

Frequently Asked Questions

Which devices are exposed to this issue?

Devices running ImsService versions prior to the SMR Sep-2026 Release 1 are affected. The provided information does not identify specific device models or Android versions.

What access does an attacker need to exploit it?

The issue is described as remotely exploitable, so the provided data indicates an attacker can attack it remotely. It does not specify any required authentication, user interaction, or network positioning.

What is the potential impact of successful exploitation?

A successful attacker can create image files with system server privilege. The provided information does not state whether this also enables file overwrite, code execution, or data access.