CVE-2026-20976
Samsung Galaxy Store ≤ 4.6.02.0
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-20976 is a medium-severity an unspecified weakness vulnerability in Samsung Galaxy Store. Its CVSS base score is 5.1 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20976 is an improper input validation vulnerability affecting the Galaxy Store application prior to version 4.6.02 on Samsung devices. Published on January 9, 2026, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE category NVD-CWE-noinfo. The flaw enables a local attacker to execute arbitrary scripts due to inadequate validation of inputs processed by the Galaxy Store.
A local attacker with low privileges on the affected device can exploit this vulnerability with low attack complexity and without requiring user interaction. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially compromising the device through arbitrary script execution.
Samsung has published a security advisory detailing the issue at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=01, with mitigation involving an update to Galaxy Store version 4.6.02 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1790
Vulnerability Data
Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.