CVE-2026-21104: Buffer Overflow

Q: What access does an attacker need before exploitation is possible?

The attacker must already have local privileged access. The issue is not described as remotely exploitable or reachable by an unprivileged local user.

Q: How can I identify potentially affected deployments?

Deployments using the KnoxVault trustlet are potentially affected if they are on a security maintenance release earlier than SMR Sep-2026 Release 1. Verify the device's installed security maintenance release against that threshold.

Published Sep 9, 2026

Updated

Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.

Affected Software

1 affected component

Google KnoxVault trustlet<SMR Sep-2026 Release 1

Event History

Sep 9, 2026

CVE Published

via MITRE·04:47 AM

Data Sourced

via MITRE·04:47 AM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need before exploitation is possible?

The attacker must already have local privileged access. The issue is not described as remotely exploitable or reachable by an unprivileged local user.

How can I identify potentially affected deployments?

Deployments using the KnoxVault trustlet are potentially affected if they are on a security maintenance release earlier than SMR Sep-2026 Release 1. Verify the device's installed security maintenance release against that threshold.