Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
PUBLISHED5.2
Problem type
- CWE-20: Improper Input Validation
Affected products
Samsung Mobile
Samsung Mobile Devices
< * - UNAFFECTED
References
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-21019Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-21019",
"assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458",
"assignerShortName": "SamsungMobile",
"dateUpdated": "2026-05-13T04:56:22.067Z",
"dateReserved": "2025-12-11T01:33:35.804Z",
"datePublished": "2026-05-13T04:56:22.067Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3af57064-a867-422c-b2ad-40307b65c458",
"shortName": "SamsungMobile",
"dateUpdated": "2026-05-13T04:56:22.067Z"
},
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege."
}
],
"affected": [
{
"vendor": "Samsung Mobile",
"product": "Samsung Mobile Devices",
"defaultStatus": "affected",
"versions": [
{
"version": "SMR May-2026 Release in Android Watch 14, 16",
"status": "unaffected",
"versionType": "semver",
"lessThan": "*"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-20: Improper Input Validation"
}
]
}
],
"references": [
{
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05"
}
],
"metrics": [
{
"format": "CVSS"
}
]
}
}
}