CVE-2026-21067

The CVSS 5.1 score on this CVE is misleading. An out-of-bounds write in libsmsd.so is not equivalent to the same primitive in an isolated user application — this daemon sits at the intersection of untrusted baseband input and the Android framework, communicating with the RIL (Radio Interface Layer) daemon via socket interface. The "local attacker" constraint in CVSS penalizes the Access Vector, but on Android, that baseline access is what every installed app already has, and the attack surface extends further: any actor capable of base station injection — including IMSI catchers or SS7-accessible adversaries — can deliver malformed PDUs that trigger the overflow through the modem. The input validation failure occurs in SMS parsing, and the specific protocol field matters. If it affects UDH, concatenated SMS, or WAP push handling, the exploitability is higher because those vectors can be triggered remotely via SMS. The key questions for your assessment: What privilege context does libsmsd.so actually run under on your device population, and is there a sandbox escape path from corruption of its heap to the RIL daemon or baseband subsystem? Treat this as a high-severity primitive regardless of the CVSS number. Map your device fleet to confirm which models carry the SMR Aug-2026 patch or later. Prioritize carriers and regions with SS7 exposure, as that's the attack surface the CVSS framework cannot model. The supply chain origin of this code — vendor-supplied modem firmware integrated by Samsung — means this is likely a class indicator, not a singleton; expect similar issues in adjacent baseband-adjacent daemons.

Reviewed through automated stages and approved by a human before publication.