# CVE-2026-21119: Samsung lib_sag_ai_sound_sep out-of-bounds memory access

Source: https://junglewise.ai/threats/cve-2026-21119-out-of-bounds-read-and-write-in-lib-sag-ai-sound-sep-v2-00-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-21119 · Severity: info · Published 2026-10-12

A memory safety vulnerability in Samsung's audio processing library allows local attackers to read and write arbitrary memory on a device. An attacker with local access could exploit this to escalate privileges, steal sensitive data, or compromise system integrity.

Technologies: [Samsung Android firmware](https://junglewise.ai/threats/technologies/android-firmware). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-21119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21119 being exploited in the wild.

**How severe is CVE-2026-21119?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Samsung Android firmware versions prior to SMR Oct-2026 Release 1.

**Is there a fix for CVE-2026-21119?** Yes: fixed in SMR Oct-2026 Release 1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21119 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-21119?** Check whether you run Samsung Android firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SMR Oct-2026 Release 1

## Technical details

An out-of-bounds read and write vulnerability exists in lib_sag_ai_sound_sep_v2.00.so, a Samsung audio separation library. Local attackers can exploit this to access memory outside the intended buffer boundaries. The vulnerability was fixed in the October 2026 Security Maintenance Release 1.

## Affected products

- Samsung Android firmware versions prior to SMR Oct-2026 Release 1

## Timeline

- 2026-10-12: disclosed

## References

- [https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=10](https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=10)

## Related threats

- [Samsung HEIF decoder improper input validation in cover image handling](https://junglewise.ai/threats/cve-2026-21124-improper-input-validation-in-getting-cover-image-in-libsimba)
- [Samsung WSM service use-after-free in SMR Oct-2026](https://junglewise.ai/threats/cve-2026-21120-use-after-free-in-wsm-service-prior-to-smr-oct-2026-release-1)
- [Samsung CocktailBarService improper access control](https://junglewise.ai/threats/cve-2026-21117-improper-access-control-in-cocktailbarservice-prior-to-smr-oct)
- [Samsung libcodec2secevrcdec out-of-bounds write](https://junglewise.ai/threats/cve-2026-21091-samsung-libcodec2secevrcdec-out-of-bounds-write)