CVE-2026-21118: Medium severity Samsung DownloadProvider vulnerability

Q: Who is realistically exposed to this issue?

Devices using Samsung DownloadProvider before the SMR Oct-2026 Release 1 are affected. Exploitation requires local access and low-level privileges on the device.

Q: What could an attacker gain through exploitation?

A local attacker could access files stored in scoped storage. The reported impact includes high confidentiality impact and low integrity and availability impact.

Q: Does exploitation require user interaction or network access?

No user interaction is required. The attack vector is local, so it is not described as remotely exploitable over a network.

Q: How can I remediate the issue?

Apply Samsung's SMR Oct-2026 Release 1 or a later security update that includes the fix.

Published Oct 12, 2026

Updated

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

Affected Software

1 affected component

Samsung DownloadProvider<SMR Oct-2026 Release 1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SMR Oct-2026 Release 1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:57 AM

Data Sourced

via MITRE·04:57 AM

DescriptionWeakness

Data Sourced

via NVD·05:17 AM

DescriptionSeverity

Frequently Asked Questions

Who is realistically exposed to this issue?

Devices using Samsung DownloadProvider before the SMR Oct-2026 Release 1 are affected. Exploitation requires local access and low-level privileges on the device.

What could an attacker gain through exploitation?

A local attacker could access files stored in scoped storage. The reported impact includes high confidentiality impact and low integrity and availability impact.

Does exploitation require user interaction or network access?

No user interaction is required. The attack vector is local, so it is not described as remotely exploitable over a network.

How can I remediate the issue?

Apply Samsung's SMR Oct-2026 Release 1 or a later security update that includes the fix.

CVE-2026-21118: Medium severity Samsung DownloadProvider vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What could an attacker gain through exploitation?

Does exploitation require user interaction or network access?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What could an attacker gain through exploitation?

Does exploitation require user interaction or network access?

How can I remediate the issue?