Samsung security patch: November 2026

Updated November 12, 2026

SMR Nov-2026 fixes 198 vulnerabilities, 20 of them critical. Android Security Bulletin: 177, Samsung Semiconductor: 4, Samsung-specific issues (SVE): 17. A Galaxy firmware with the security patch level 2026-11-01 or later includes all of these fixes.

By the Samsung update data we track, 4 Galaxy models have received builds with this patch level so far. The first one was SM-S741B (Galaxy S26 FE) on 2026-11-12.

Vulnerabilities fixed in SMR Nov-2026

Samsung-specific fixes (17 disclosed)

• highSVE-2026-3546 / CVE-2026-21155
  Out-of-bounds write in bootloader prior to SMR Nov-2026 Release 1 allows physical attackers to write out-of-bounds memory.
  Affected: Android 14, 15, 16, 17
• highSVE-2026-4330 / CVE-2026-21152
  Improper input validation in libMyFilterPlugin.camera.samsung.so prior to SMR Nov-2026 Release 1 allows local attackers to potentially execute arbitrary code. User interaction is required for triggering this vulnerability.
  Affected: Android 14, 15, 16, 17
• highSVE-2026-4711 / CVE-2026-21153
  Stack-based buffer overflow in libsecuibc.so prior to SMR Nov-2026 Release 1 allows local attackers to execute arbitrary code.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2025-2334 / CVE-2026-21141
  Improper access control in Samsung Dialer prior to SMR Nov-2026 Release 1 allows local attackers to access sensitive information.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0172 / CVE-2026-21142
  Incorrect default permissions in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to access profile configuration.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0241 / CVE-2026-21143
  Improper authorization in CoverScreenRecentsWidgetProvider in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to make a call without proper permission.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0243 / CVE-2026-21144
  Improper authorization in RecentsCallLogLargeWidgetProvider in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to make a call without proper permission.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0247 / CVE-2026-21145
  Improper export of android application components in CoverScreenWidgetActionActivityLarge in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to make a call without proper permission.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0248 / CVE-2026-21146
  Improper export of android application components in CoverScreenWidgetActionActivitySmall in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to make a call without proper permission.
  Affected: Android 14, 15, 16
• moderateSVE-2026-0249 / CVE-2026-21147
  Improper export of android application components in CoverScreenWidgetActionActivity in Samsung Contacts prior to SMR Nov-2026 Release 1 allows local attackers to make a call without proper permission.
  Affected: Android 14, 15, 16
• moderateSVE-2026-1474 / CVE-2026-21148
  Incorrect authorization in Samsung Messages prior to SMR Nov-2026 Release 1 allows local attackers to access sensitive information.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2026-2458 / CVE-2026-21149
  Improper access control in StatusBarManagerService prior to SMR Nov-2026 Release 1 allows local attackers to use the privileged APIs.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2026-3849 / CVE-2026-21156
  Out-of-bounds write in libsmkvextractor.so prior to SMR Nov-2026 Release 1 allows local attackers to write out-of-bounds memory.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2026-4155 / CVE-2026-21150
  Improper access control in edmnativehelper prior to SMR Nov-2026 Release 1 allows local attackers to access sensitive information.
  Affected: Android 15, 16, 17
• moderateSVE-2026-4199 / CVE-2026-21158
  Improper certificate validation in CP prior to SMR Nov-2026 Release 1 allows local privileged attackers to bypass SIM lock.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2026-4221 / CVE-2026-21151
  Improper privilege management in TransitionPlayer prior to SMR Nov-2026 Release 1 allows local privileged attackers to execute arbitrary code with launcher privilege.
  Affected: Android 14, 15, 16, 17
• moderateSVE-2026-5527 / CVE-2026-21154
  Improper authorization in libsecuibc.so prior to SMR Nov-2026 Release 1 allows local attackers to access dump data.
  Affected: Android 14, 15, 16, 17

Galaxy models with the November 2026 patch

Earliest release first. Dates are the first region release from Samsung's update documentation. Regions: CSC regions with this patch / all regions the model has builds for. Update tier: how often Samsung promises security updates for the model (EE: Enterprise Edition).

Galaxy S (4)

Still waiting for the November 2026 patch (595)

Galaxy models with a firmware build in the last four months whose newest build has an older patch level, monthly update tier first. Quarterly models may skip this month and get a later patch, which includes these fixes as well.

FAQ

Some Samsung-specific items are not disclosed by Samsung and are not listed.