{"id":"CVE-2026-21157","kind":"vulnerability","aliases":["CVE-2026-21157"],"related":[],"title":"Samsung Bixby: input validation flaw lets local attackers launch arbitrary activities","description":"Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.","summary":"Bixby, Samsung's voice assistant, before version 4.0.85.6 does not properly validate input. A privileged local attacker can use this to launch arbitrary activities on the device.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other","samsung"],"not_affected_if":["bixby-updated"],"how_to_check":"- Check the installed Bixby version in Settings > Apps > Bixby, or the unknown package version on a managed device.\n- unknown for any other check, the sources do not say.","fix":"- Update Bixby to `4.0.85.6` or later through the Galaxy Store or system update.","status":"open","published_at":"2026-10-29T01:17:23+00:00","first_seen_at":"2026-10-29T01:36:30+00:00","triaged_at":"2026-10-29T01:37:39+00:00","updated_at":"2026-10-29T01:37:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T01:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update Bixby to `4.0.85.6` or later through the Galaxy Store or system update.","reach":"local","title":"Samsung Bixby: input validation flaw lets local attackers launch arbitrary activities","impact":"medium","summary":"Bixby, Samsung's voice assistant, before version 4.0.85.6 does not properly validate input. A privileged local attacker can use this to launch arbitrary activities on the device.","category":"other","nicknames":[],"who_cares":["samsung","android","mobile"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker launches arbitrary activities on the device with local privileges","analyst_note":"Confirm the affected Bixby package name and whether the fix is delivered via Galaxy Store or firmware; the NVD entry alone does not say.","how_to_check":"- Check the installed Bixby version in Settings > Apps > Bixby, or the unknown package version on a managed device.\n- unknown for any other check, the sources do not say.","needs_analyst":true,"not_affected_if":["bixby-updated"],"who_is_affected":"Samsung devices with Bixby installed before version `4.0.85.6`. The sources describe a privileged local attacker, so exposure depends on an attacker already having a foothold on the device. Fleet owners running Samsung handsets should verify the Bixby version. Exposure for devices without Bixby is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000589,"input_tokens":3265,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-21157':14A,17A '4.0.85.6':29B,57C 'activ':11A,45B,65C 'allow':58C 'android':18B 'arbitrari':10A,44B,64C 'assist':26B 'attack':8A,38B,61C 'bixbi':2A,22B,53C 'cve':12A,15A 'devic':48B 'flaw':5A 'improp':49C 'input':3A,34B,50C 'launch':9A,43B,63C 'let':6A 'local':7A,37B,60C 'mobil':19B 'prior':54C 'privileg':36B,59C 'proper':32B 'samsung':1A,21B,23B 'use':40B 'valid':4A,33B,51C 'version':28B,56C 'voic':25B","nicknames":[],"mitigations":[],"who_affected":"Samsung devices with Bixby installed before version `4.0.85.6`. The sources describe a privileged local attacker, so exposure depends on an attacker already having a foothold on the device. Fleet owners running Samsung handsets should verify the Bixby version. Exposure for devices without Bixby is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T01:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-21157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21157","severity":null,"published_at":"2026-10-29T01:17:23+00:00","modified_at":"2026-10-29T01:17:23+00:00","first_seen_at":"2026-10-29T01:36:30+00:00","fetched_at":"2026-10-29T01:36:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}