CVE-2026-21115: Medium severity Samsung libcodec2-sec-flacdec.so vulnerability
Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libcodec2-sec-flacdec.soto a version that resolves this vulnerability.Patch SMR Oct-2026 Release 1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The issue affects Samsung systems that include libcodec2-sec-flacdec.so before the SMR Oct-2026 Release 1 update. Exploitation is local, so an attacker needs the ability to execute code or otherwise act locally on the affected device.
Does exploitation require user interaction or prior privileges?
The supplied CVSS vector indicates no user interaction and no privileges are required. It also indicates low attack complexity and that the attack is performed locally.
What is the impact if the vulnerability is exploited?
Successful exploitation allows an out-of-bounds memory write. The CVSS assessment indicates low impact to integrity and availability, with no assessed confidentiality impact.
How can I determine whether a device may be affected?
Check whether the device includes Samsung libcodec2-sec-flacdec.so and whether its security maintenance release is earlier than SMR Oct-2026 Release 1. Devices updated to that release are outside the stated affected range.