CVE-2026-21014

Received Received - Intake

Improper Access Control in Samsung Camera Exposes Location Data

Publication date: 2026-04-13

Last updated on: 2026-04-16

Assigner: Samsung Mobile

Description

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-13

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-13

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21014

EUVD

EUVD-2026-21872

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	camera	to 16.5.00.28 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in the Samsung Camera application prior to version 16.5.00.28. It allows a local attacker to access location data stored or managed by the camera app. However, the attacker must have some level of user interaction to trigger this vulnerability.

Impact Analysis

The vulnerability can lead to unauthorized access to location data by a local attacker. This could compromise your privacy by exposing sensitive location information that you may not want to be accessed by others.

Mitigation Strategies

To mitigate this vulnerability, update the Samsung Camera application to version 16.5.00.28 or later.

Since the vulnerability requires user interaction to be triggered, avoid interacting with untrusted prompts or requests within the camera app.

Hi! I’m here to help you understand CVE-2026-21014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70