CVE-2026-21113

Analyzed Analyzed - Analysis Complete

Improper Component Export in Samsung Visual Voicemail

Publication date: 2026-09-09

Last updated on: 2026-09-23

Assigner: Samsung Mobile

Description

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-23

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-21113

EUVD

EUVD-2026-74654

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	visual_voicemail	to 20.1.00.05 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

This vulnerability involves an improper export of Android application components in Visual Voicemail software before version 20.1.00.05. Attackers with local access can exploit this to initiate calls without the required permissions.

Detection Guidance

This vulnerability involves improper export of Android application components in Visual Voicemail. Detection requires checking the application's manifest for exported components without proper permissions. Use Android Studio or APKTool to inspect the manifest file for components with exported=true and no appropriate permission restrictions.

Impact Analysis

An attacker could use this flaw to make unauthorized calls from your device, potentially leading to unexpected charges or misuse of your phone line. It may also allow interception of call-related data.

Compliance Impact

The vulnerability allows local attackers to initiate calls without proper permissions, which could lead to unauthorized access to voicemail or call functionality. This may violate data protection principles under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized disclosure of protected health information if voicemails contain such data). However, specific compliance impacts depend on how the application handles personal or sensitive data.

Mitigation Strategies

Update Visual Voicemail to version 20.1.00.05 or later to address the improper export of application components.

Hi! I’m here to help you understand CVE-2026-21113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70