CVE-2026-21087 is an out-of-bounds write in libmdnie.so on Samsung Android devices. The record scores it 7.8 (High) and says a local attacker could execute arbitrary code with system server privilege. The record names SMR Sep-2026 Release 1 as the fixed release, so apply the September 2026 Samsung update.
What's affected
The CVE record says libmdnie.so is fixed in SMR Sep-2026 Release 1 for Samsung Android devices. The Samsung bulletin page we fetched did not list this CVE, so the affected Android versions are not confirmed here. Treat Samsung devices below the September 2026 patch level as potentially affected and check with Samsung.
Source conflict to note: the record scores this 7.8 (High), and we could not confirm Samsung's own severity because the vendor page did not include the entry.
Weakness class: CWE-787.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and read the Android security patch level. Samsung ships these fixes in the Samsung Mobile Security Maintenance Release (SMR) named in the bulletin, so a September 2026 patch level or later is the thing to look for. If you manage a fleet, your mobile device management console can report the patch level and Android version per device.
The bulletin lists Android 14, 15, 16 and 17 as affected, so any current Samsung device on those versions that has not taken the September 2026 SMR should be treated as exposed. Samsung does not publish a per-model table on the page, so check the update status on the device itself rather than assuming from the model name.
What to do now
- Install the September 2026 Samsung security update (SMR Sep-2026 Release 1) on every managed Samsung device. Carriers sometimes roll it out later than Samsung, so confirm on the device.
- Prioritize this one a little above the other Samsung items this month: the record describes code execution at system server level, not just an information leak.
- Report the patch level in your MDM inventory and set a compliance rule that flags devices more than one SMR behind.
- Keep the Samsung bulletin as your source of truth, and re-read it, because the vendor updated its vulnerability list after first publication.
Why it matters
libmdnie is part of Samsung's display image processing. An out-of-bounds write (CWE-787) means code writes data past the end of a buffer, which can corrupt memory next to it. In native libraries that is a classic route to code execution, and the record says the result here is code running with system server privilege, which is far above an ordinary app.
The attack vector in the record is local, with low complexity and low privileges required and no user interaction. That means the attacker needs code already running on the device, for example a malicious or compromised app. Local flaws still matter on phones, because the app sandbox is the main wall between one app and the rest of the device, and a bug in a system component can let one app reach beyond it.
The CISA Known Exploited Vulnerabilities flag is false in the record, and the Samsung bulletin we read does not describe exploitation. Treat this as a patch in the normal monthly cycle, not an emergency, but do not let it sit for months.
Quick check
What privilege does the attacker gain?
The record says arbitrary code execution with system server privilege, reached from a local starting point.
Is it in Samsung's bulletin table?
The bulletin page we read did not list this CVE in its table, so the fixed release comes from the CVE record. Verify against Samsung's current bulletin and the device's patch level.
Sources
Last reviewed: 18 October 2026.
