Loading vulnerability…
CVE-2026-21018 is an out-of-bounds write vulnerability in Samsung SveService affecting versions prior to the SMR May-2026 Release 1. The flaw allows memory to be written past an intended buffer boundary, creating a memory corruption condition in the vulnerable service. According to the available information, exploitation is possible by a local privileged attacker and can result in arbitrary code execution within the context of the affected component.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small Python proof-of-concept demonstrating insecure OPC UA access when a server is configured with the None/NoSecurity policy, described as CVE-2026-21018 in the README. The repository contains two code files: a simulated vulnerable server (opcua_server_sim.py) and a minimal exploit client (exploit_opcua_none.py), plus a README and license. The exploit capability is limited but clear: it creates an OPC UA client and connects to opc.tcp://localhost:4840/freeopcua/server/ without authentication, showing that unsecured endpoints can be reached by any network user. The server simulator binds to opc.tcp://0.0.0.0:4840/freeopcua/server/ and explicitly enables NoSecurity, making it intentionally vulnerable for demonstration. There is no post-exploitation logic, credential theft, shell payload, or automated tag manipulation; therefore this is best classified as a proof-of-concept rather than an operational exploit. One code quality note: opcua_server_sim.py references ua.SecurityPolicyType.NoSecurity but does not import ua, so the simulator as written may fail unless corrected. Overall, the repository’s purpose is to illustrate the risk of exposing OPC UA services with no authentication or encryption, where an attacker on the network could connect and potentially read or write industrial control tags.
Repository is a small standalone proof-of-concept for Samsung SveService Binder exploitation tied to SVE-2026-0478 / CVE-2026-21018. It contains one Java exploit and one helper shell script, duplicated both at repository root and under poc/. The Java PoC uses reflection to access android.os.ServiceManager, resolves the Binder service named "SveService", writes the interface token "com.sec.sve.ISecVideoEngineService", and invokes Binder transaction 38 (documented as sveSetCodecInfo). It first performs a normal call with size values 1,1,1, then sends -1,-1,-1 as the final three integer parameters after constructing the expected Parcel layout with placeholder ints, booleans, a string, and three 1-byte arrays. According to the README, these integers flow into native libsvejni.so code without bounds checking and are used by memset, memcpy, and stack allocation logic, causing a deterministic crash and potentially enabling arbitrary code execution for a local privileged attacker with further exploitation work. The shell script compiles the Java source against android-36, converts it to DEX with d8, pushes classes.dex to /data/local/tmp/poc_sve.dex via adb, and executes it on-device using app_process. No network communication or remote C2 exists; the exploit is purely local and targets an exposed Android system Binder service. The repository’s purpose is to demonstrate reachability and crashability of the vulnerable native path, not to provide a full weaponized RCE chain.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.