CVE-2026-21157
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
Risk Assessment
A local attacker with sufficient privileges can launch arbitrary activities, potentially leading to unauthorized actions on the device.
Recommendation
Update Bixby to version 4.0.85.6 or later to remediate the vulnerability.
Other vulnerabilities in Bixby
See all- CVE-2026-21074High
Incorrect default permissions in Bixby prior to version 4.0.86.0 allow local attackers to execute arbitrary commands with Bixby privilege.
- CVE-2026-21055High
The vulnerability in Bixby prior to version 4.0.70.8 is caused by improper export of Android application components. A local attacker can exploit this to execute arbitrary commands with Bixby privileges.
Original NVD description (English source)
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS