Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-21042
Samsung Mobile Samsung Mobile Devices — Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N L N H H L 8.7 .0044 35.7 —
AFFECTED
Product Versions Fixed
Samsung Mobile Devices unspecified SMR Jul-2026 Release in Android 14, 15, 16
TIMELINE
Dec 11 Reserved by SamsungMobile
Jul 10 Published (CNA: SamsungMobile)
Sep 9 RESCORED — CVE-2026-21042 (Samsung Mobile Devices). CVSS 8.4 → 8.7 (NVD).
Description
Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| December 11, 2025 | Reserved | Reserved by SamsungMobile |
| July 10, 2026 | Published | Published (CNA: SamsungMobile) |
| September 9, 2026 | RESCORED | RESCORED — CVE-2026-21042 (Samsung Mobile Devices). CVSS 8.4 → 8.7 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Samsung Mobile | Samsung Mobile Devices | — | — | SMR Jul-2026 Release in Android 14, 15, 16 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-21042 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
