CVE-2026-21085

CVE-2026-21085 is an out-of-bounds write vulnerability in the Keymaster trustlet, the secure-world (TEE) component on Samsung mobile devices that manages cryptographic key material and device security operations. The flaw is triggered when a local privileged attacker (an attacker who has already gained high privileges on the device) causes the trustlet to write beyond its allocated memory buffer. A successful exploit yields high-impact compromise of the vulnerable secure component, with high ratings for confidentiality, integrity, and availability, though the attack does not propagate to the normal system per the CVSS scoring. Affected devices are Samsung mobile devices that have not received Samsung's SMR Sep-2026 Release 1 security maintenance release. As of now, there is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply Samsung's SMR Sep-2026 Release 1 (security patch level September 2026 or later) via the device software-update mechanism and confirm the installed patch level in Settings. Because exploitation requires local privileged access, risk of standalone remote compromise is low, but patching closes the flaw for use in chained attacks where an attacker has already gained elevated privileges on the device.