CVE-2026-20989: 
NixOS vulnerability analysis and mitigation

CVE-2026-20989 is an improper cryptographic signature verification vulnerability in the Font Settings component of Samsung Android (One UI), classified under CWE-347. It allows a physical attacker to bypass signature checks and load unauthorized custom fonts on affected devices. The vulnerability affects Samsung Android 16.0 builds prior to the SMR Mar-2026 Release 1 security patch (including SMR Aug-2025-R1 through SMR Feb-2026-R1). It was published on March 16, 2026, with a patch released in the March 2026 Samsung Monthly Release. The CVSS v3.1 base score is 2.4 (Low), while the CVSS v4.0 base score is 5.1 (Medium) (Samsung Security).

The root cause is improper verification of cryptographic signatures (CWE-347) within the Font Settings feature of Samsung's One UI on Android 16. The Font Settings component fails to adequately validate the cryptographic signature of font files before applying them, allowing a physically present attacker to supply and install a custom, unsigned or improperly signed font file. Exploitation requires physical access to the device — no network connectivity, elevated privileges, or user interaction is needed beyond the physical presence itself. No public proof-of-concept or detailed technical write-up has been identified at this time (Samsung Security).

Successful exploitation allows a physical attacker to load arbitrary custom fonts on the target Samsung device, bypassing the intended cryptographic controls. This primarily affects system integrity — specifically the visual presentation layer — enabling UI spoofing, misleading information display, or other visual-based attacks that could deceive users or manipulate how application interfaces appear. There is no impact on confidentiality or availability, and the vulnerability does not facilitate lateral movement or remote code execution (Samsung Security).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.015% (0.000150), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Physical access to the device is a hard prerequisite, significantly limiting the attacker pool (Samsung Security).

1. Physical Access: Obtain physical access to a Samsung Galaxy device running Android 16 with a security patch level prior to SMR Mar-2026 Release 1.
2. Prepare Malicious Font: Craft or obtain a custom font file (e.g., a TTF or OTF file) that would normally be rejected due to an invalid or missing cryptographic signature.
3. Access Font Settings: Navigate to the device's Font Settings (typically under Display > Font Size and Style) or use a sideloading mechanism to introduce the custom font file to the device.
4. Bypass Signature Check: Due to the improper signature verification, the Font Settings component accepts and applies the unsigned or improperly signed custom font without rejecting it.
5. Achieve Objective: The malicious font is applied system-wide or within targeted applications, enabling visual manipulation of UI elements for purposes such as UI spoofing or misleading information display (Samsung Security).

• File System: Presence of unexpected or unsigned font files (TTF/OTF) in font directories on the device (e.g., /data/fonts/ or user font storage paths).
• Device Settings: Font Settings showing an active custom font not installed through official Samsung or Google Play channels.
• Logs: Device logs (accessible via ADB) showing font loading events from non-standard or unverified sources without corresponding signature validation success entries.

Samsung has addressed this vulnerability in the SMR Mar-2026 Release 1 security patch for Samsung Android 16. Users should update their Samsung devices to the March 2026 security patch level or later as the primary remediation. As a workaround, organizations and users should restrict physical access to devices and enforce policies against unauthorized font installation. Monitoring Font Settings configurations for unauthorized custom fonts is also recommended (Samsung Security).

Following the March 2026 Samsung security update, several tech outlets reported that the patch effectively broke existing custom font support on Galaxy devices running One UI 8.5, generating user frustration. Sites including PiunikaWeb, SammyGuru, SammyFans, and AndroidHeadlines covered the side effect, noting that the security fix silently disabled a popular customization feature (PiunikaWeb, SammyGuru, AndroidHeadlines). The community reaction was mixed — users were frustrated by the loss of functionality, while security observers noted the low severity of the underlying vulnerability relative to the user-visible impact of the fix.