CVE-2026-21120

Awaiting Analysis Awaiting Analysis - Queue

Use After Free in WSM Service Prior to SMR Oct-2026 Release 1

Publication date: 2026-10-12

Last updated on: 2026-10-13

Assigner: Samsung Mobile

Description

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-21120

EUVD

EUVD-2026-97184

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	wsm	to 2026-10-01 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use after free issue in the WSM service prior to the Samsung October 2026 Release 1. It allows local attackers to potentially execute arbitrary code with system privileges by exploiting a memory management flaw.

Detection Guidance

Detection of CVE-2026-21120 requires checking for use-after-free vulnerabilities in the WSM service. Samsung recommends updating to the SMR Oct-2026 Release 1 or later to address this issue. No specific commands are provided in the available context for detection.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to run malicious code on your device with system-level permissions. This could lead to unauthorized data access, system control, or further compromise of the device.

Compliance Impact

The vulnerability allows local attackers to execute arbitrary code with system privileges due to a use-after-free issue in the WSM service. This could lead to unauthorized access or control of affected systems, potentially compromising sensitive data. Such risks may impact compliance with standards like GDPR or HIPAA by increasing the likelihood of data breaches or unauthorized disclosures.

Mitigation Strategies

Apply the SMR Oct-2026 Release 1 or later update from Samsung to patch the WSM service use-after-free vulnerability.

Hi! I’m here to help you understand CVE-2026-21120. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70