CVE-2026-20970
Published: 09 January 2026
Summary
CVE-2026-20970 is a medium-severity an unspecified weakness vulnerability in Samsung Android. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-20970 is an improper access control vulnerability in the SLocation component, affecting Samsung devices prior to the SMR Jan-2026 Release 1. This flaw allows local attackers to execute privileged APIs that should otherwise be restricted, as detailed in the CVE description. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.
A local attacker with low privileges on the affected device can exploit this vulnerability without requiring user interaction. Successful exploitation enables execution of privileged APIs in SLocation, potentially granting unauthorized access to sensitive location data or system functions, resulting in high impacts on confidentiality, integrity, and availability.
Samsung's security advisory for January 2026, available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=01, addresses this issue. Mitigation involves updating to SMR Jan-2026 Release 1 or later, which resolves the improper access control in SLocation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1793
Vulnerability details
Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in SLocation directly enables local low-privileged attackers to invoke restricted privileged APIs, matching the definition of T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for access to system resources, directly addressing the improper access control allowing local low-privilege attackers to execute privileged APIs in SLocation.
AC-6 enforces least privilege, preventing low-privilege local attackers from gaining unauthorized access to privileged APIs in the SLocation component.
SI-2 mandates timely identification, reporting, and correction of system flaws, directly mitigating this vulnerability through patching as provided in SMR Jan-2026 Release 1.