CVE-2026-21074
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Incorrect default permissions in Bixby prior to version 4.0.86.0 allow local attackers to execute arbitrary commands with Bixby privilege.
Risk Assessment
A local attacker could take control of Bixby features and perform unauthorized operations on the device.
Recommendation
Update Bixby to version 4.0.86.0 or later to fix the incorrect permissions.
Other vulnerabilities in Bixby
See all- CVE-2026-21157High
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
- CVE-2026-21055High
The vulnerability in Bixby prior to version 4.0.70.8 is caused by improper export of Android application components. A local attacker can exploit this to execute arbitrary commands with Bixby privileges.
Original NVD description (English source)
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS