CVE-2026-21115: Medium severity Samsung libcodec2-sec-flacdec.so vulnerability

Q: Who is realistically exposed to this issue?

The issue affects Samsung systems that include libcodec2-sec-flacdec.so before the SMR Oct-2026 Release 1 update. Exploitation is local, so an attacker needs the ability to execute code or otherwise act locally on the affected device.

Q: Does exploitation require user interaction or prior privileges?

The supplied CVSS vector indicates no user interaction and no privileges are required. It also indicates low attack complexity and that the attack is performed locally.

Q: What is the impact if the vulnerability is exploited?

Successful exploitation allows an out-of-bounds memory write. The CVSS assessment indicates low impact to integrity and availability, with no assessed confidentiality impact.

Q: How can I determine whether a device may be affected?

Check whether the device includes Samsung libcodec2-sec-flacdec.so and whether its security maintenance release is earlier than SMR Oct-2026 Release 1. Devices updated to that release are outside the stated affected range.

Published Oct 12, 2026

Updated

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Affected Software

1 affected component

Samsung libcodec2-sec-flacdec.so<SMR Oct-2026 Release 1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libcodec2-sec-flacdec.so to a version that resolves this vulnerability.
Patch SMR Oct-2026 Release 1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:57 AM

Data Sourced

via MITRE·04:57 AM

DescriptionWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverity

Frequently Asked Questions

Who is realistically exposed to this issue?

The issue affects Samsung systems that include libcodec2-sec-flacdec.so before the SMR Oct-2026 Release 1 update. Exploitation is local, so an attacker needs the ability to execute code or otherwise act locally on the affected device.

Does exploitation require user interaction or prior privileges?

The supplied CVSS vector indicates no user interaction and no privileges are required. It also indicates low attack complexity and that the attack is performed locally.

What is the impact if the vulnerability is exploited?

Successful exploitation allows an out-of-bounds memory write. The CVSS assessment indicates low impact to integrity and availability, with no assessed confidentiality impact.

How can I determine whether a device may be affected?

Check whether the device includes Samsung libcodec2-sec-flacdec.so and whether its security maintenance release is earlier than SMR Oct-2026 Release 1. Devices updated to that release are outside the stated affected range.

CVE-2026-21115: Medium severity Samsung libcodec2-sec-flacdec.so vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

Does exploitation require user interaction or prior privileges?

What is the impact if the vulnerability is exploited?

How can I determine whether a device may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

Does exploitation require user interaction or prior privileges?

What is the impact if the vulnerability is exploited?

How can I determine whether a device may be affected?