CVE-2026-21027

Vulnerability

Improper export of Android application components within ImsSettings allows local attackers to trigger logging functions. This vulnerability affects versions prior to the SMR Jun-2026 Release 1 [1].

Exploitation

An attacker with local access to the affected device can exploit this vulnerability by triggering the logging function through the improperly exported components. No specific user interaction or elevated privileges beyond local access are mentioned in the available references.

Impact

Successful exploitation allows local attackers to trigger the logging function. The specific impact on confidentiality, integrity, or availability is not detailed in the provided references, but triggering logging functions could potentially lead to unintended information disclosure or denial of service.

Mitigation

This vulnerability is addressed in the SMR Jun-2026 Release 1 [1]. Users are advised to update their devices to this release or a later version. Information regarding workarounds or if the vulnerability is listed on the KEV catalog is not yet disclosed in the available references.