Live › vulnerability › CVE-2026-21157
Go to dashboardBixby, Samsung's voice assistant, before version 4.0.85.6 does not properly validate input. A privileged local attacker can use this to launch arbitrary activities on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 01:36 UTC. All times on this page are UTC.
Samsung devices with Bixby installed before version . The sources describe a privileged local attacker, so exposure depends on an attacker already having a foothold on the device. Fleet owners running Samsung handsets should verify the Bixby version. Exposure for devices without Bixby is unknown.
4.0.85.6No product ranges from the sources yet.
4.0.85.6 or later through the Galaxy Store or system update.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
This page as .md · .json · in your agent: get_signal("CVE-2026-21157")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.