CVE-2026-20972: 
NixOS vulnerability analysis and mitigation

CVE-2026-20972 is an Improper Export of Android Application Components vulnerability in Samsung's UwbTest application that allows local attackers with low privileges to enable Ultra-Wideband (UWB) functionality without proper authorization. It affects Samsung Android versions 13, 14, 15, and 16 with any Samsung Mobile Release (SMR) prior to January 2026 Release 1. The vulnerability was published on January 9, 2026, and patched on January 15, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Samsung Advisory).

The vulnerability is classified under CWE-926 (Improper Export of Android Application Components), meaning the UwbTest application improperly exports one or more of its Android components (e.g., an Activity, Service, or BroadcastReceiver) without adequate access controls. This allows any local application with low privileges to interact with the exported component and trigger UWB enablement without requiring elevated permissions or user interaction. The attack vector is local, requires low privileges, and no user interaction, making it straightforward to exploit on a device where a malicious app is already installed (Samsung Advisory).

Successful exploitation allows a local low-privilege attacker to enable UWB (Ultra-Wideband) functionality on affected Samsung devices without authorization. This could facilitate unauthorized proximity-based interactions, unauthorized data transmission using UWB radio capabilities, or circumvention of device policies that restrict UWB usage. The impact is limited to integrity (low) with no confidentiality or availability impact per the CVSS v3.1 assessment, though the CVSS v4.0 score reflects a low availability impact as well (Samsung Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access to the device and a low-privilege application, limiting the attack surface to scenarios where a malicious app is already installed (Samsung Advisory).

1. Install a malicious app: The attacker installs a low-privilege Android application on the target Samsung device (e.g., via sideloading or a third-party app store).
2. Identify the exported component: The malicious app inspects the UwbTest application's manifest (or uses tools like dumpsys or pm dump) to identify the improperly exported component (Activity, Service, or BroadcastReceiver).
3. Send an intent to the exported component: The malicious app crafts and sends an explicit Android Intent targeting the exported UwbTest component (e.g., adb shell am start -n com.samsung.uwbtest/.ExportedComponent or programmatically via startActivity()/startService()).
4. UWB enabled without authorization: The exported component processes the intent and enables UWB functionality on the device, bypassing any access controls or user consent that should normally be required (Samsung Advisory).

• Logs: Android system logs (logcat) showing unexpected invocations of UwbTest components from third-party applications; entries indicating UWB state changes not initiated by the user or a trusted system process.
• Process/Application Behavior: Unexpected UWB radio activation on devices where UWB was previously disabled; third-party apps sending explicit intents to com.samsung.uwbtest package components.
• File System: Presence of unknown or untrusted APKs on the device that reference UwbTest component names in their code or manifest.

Samsung has addressed this vulnerability in SMR Jan-2026 Release 1, available for Samsung Android versions 13, 14, 15, and 16. Users and administrators should apply the January 2026 Samsung security patch to all affected devices as soon as possible. No configuration-based workaround is publicly documented; patching is the only recommended remediation. Enterprise administrators should prioritize patch deployment through their mobile device management (MDM) solutions (Samsung Advisory).

Coverage of this vulnerability has been limited to routine security patch reporting. Samsung Fans and tech blogs noted the January 2026 SMR patch bundle, which included 55 fixes. No notable researcher commentary or significant community discussion specific to CVE-2026-20972 has been identified beyond standard vulnerability database aggregation (Samsung Advisory).