CVE-2026-21068 is a high severity (CVSS 7.8 in the record) flaw in Samsung Android: a stack-based buffer overflow in libril_sem.so, which lets a privileged local attacker execute arbitrary code. Samsung rates it Moderate in its bulletin. It affects Android 14, 15 and 16 and is fixed in the August 2026 security maintenance release, SMR Aug-2026 Release 1.
What's affected
Samsung's August 2026 security bulletin lists this issue as SVE-2026-2525 and says it affects Android 14, 15 and 16. The fix is SMR Aug-2026 Release 1. Devices on a patch level older than that release are affected. The record's product field is simply Samsung Android, so the bulletin is the better guide to which Android versions apply.
Where the sources differ: the NVD record scores it 7.8 (High), while Samsung's bulletin places it in its Moderate category and gives no CVSS score. Samsung's severity scale is its own and is applied to its own threat model. Plan the update on the higher reading.
The weakness is listed as CWE-121 (stack-based buffer overflow). The record says exploitation needs local access. A local attacker means a malicious app or a person with the device in hand, not someone across the internet. The KEV flag is false and the bulletin does not report exploitation. The August bulletin fixes several related issues in Samsung codecs and system libraries, so one monthly update covers them together.
How to check if you're exposed
On the phone, open Settings, then About phone, then Software information, and read the Android security patch level. A level of August 1, 2026 or later means the August 2026 maintenance release is installed. Anything earlier is missing the fix.
For a fleet, use your mobile device management console to report patch level by device, and list models still on an older level. Devices that no longer receive updates from Samsung cannot be fixed by waiting, so mark them for replacement. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see device firmware or Android system library issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Check the security patch level on managed and personal Samsung devices that access company data.
- Install the August 2026 update, or any later monthly update, from Settings, Software update.
- Push the update through your MDM and set a compliance rule for a minimum patch level.
- Review the apps installed on devices that cannot update yet, and remove anything you do not recognise, since the attacker model is a local app.
- Keep Play Protect on, and restrict installs from unknown sources.
- Retire devices that Samsung no longer supports.
Why it matters
CWE-121 (stack-based buffer overflow): a stack-based buffer overflow in libril_sem.so. In plain terms, the code handles data it should have checked, and the mistake lets a privileged local attacker execute arbitrary code. Codec and system libraries process files and messages that apps and the network hand to them, so they are common places for memory bugs on phones.
The attacker needs local access, and Samsung rates the issue Moderate, so this is a routine monthly patch rather than an emergency. The reason to stay current is that local bugs combine. A malicious app that gains a little extra reach from one flaw can use it as a step toward something bigger. Keeping the monthly patch level current removes that step.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How do I know if the fix is installed?
Check that the Android security patch level reads August 1, 2026 or later, which matches SMR Aug-2026 Release 1.
Why do the record and Samsung disagree on severity?
The record scores it 7.8 (High) with the standard CVSS method. Samsung's bulletin uses its own Moderate rating and shows no CVSS number. Both describe the same fix.
Sources
Last reviewed: 18 October 2026.
