CVE-2026-21121: Medium severity Samsung CmcCore vulnerability

Q: Who can exploit this issue?

An attacker needs local access to a device running an affected version of Samsung CmcCore. The vulnerability does not require privileges or user interaction according to the supplied CVSS vector.

Q: What could an attacker gain by exploiting it?

A local attacker may be able to use privileged APIs because CmcCore improperly handles insufficient permissions. The reported impact is high confidentiality impact, with no reported integrity or availability impact.

Q: Which releases are affected and what is the fix?

CmcCore versions prior to SMR Oct-2026 Release 1 are affected. Updating to SMR Oct-2026 Release 1 or later addresses the issue.

Published Oct 12, 2026

Updated

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

Affected Software

1 affected component

Samsung CmcCore<SMR Oct-2026 Release 1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CmcCore to a version that resolves this vulnerability.
Patch SMR Oct-2026 Release 1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:57 AM

Data Sourced

via MITRE·04:57 AM

DescriptionWeakness

Data Sourced

via NVD·05:17 AM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access to a device running an affected version of Samsung CmcCore. The vulnerability does not require privileges or user interaction according to the supplied CVSS vector.

What could an attacker gain by exploiting it?