Patching

Samsung's October patch reaches Galaxy S25: what's in it

Samsung's October 2026 release adds MediaTek modem, work profile and media parser fixes to Google's patches. What applies to which Galaxy, and how to roll it out.

By Yaali. October 20, 2026, 7 min read, Patching, Mobile, Vulnerabilities.

Samsung started shipping its October 2026 Security Maintenance Release (SMR) to the Galaxy S25, S25+ and S25 Ultra on October 19, beginning in South Korea. The S25 Ultra build is S938NKSSDDZJ2, about 539 MB, and it is the first update for the line since One UI 9.0 (Android 17). It carries security fixes only. The Galaxy S26 series received the same release at the end of September, so the S25 is the first of last year's flagships to follow.

Samsung's bulletin, published October 6, combines Google's Android patches with fixes of its own, and none of them is flagged as exploited. The parts that are not in Google's bulletin, which we covered in our October Android post, are the ones Galaxy admins need to read: two Critical MediaTek modem bugs reachable from a fake cell tower, a work profile weakness in the Locksettings service, and a set of image and media parser bugs that exist only on Galaxy phones. Which of them apply depends on the chip inside each model.

Stat tiles for Samsung's October 2026 SMR (45 Google patches with 9 Critical, 27 Samsung SVE items of which 13 are described, 4 Samsung Semiconductor fixes, 0 flagged as exploited) beside which extra items apply by chip: Snapdragon models such as the Galaxy S25, Exynos models, and MediaTek models with CVE-2026-20519 and CVE-2026-20520

What is in Samsung's release

The Google part lists 45 patches: 9 Critical, 33 High and 3 Moderate. Seven of the Critical ones are the Android bulletin's Framework and System bugs. The other two, CVE-2026-20519 and CVE-2026-20520, come from MediaTek's own October bulletin. Samsung also notes that CVE-2026-28667, CVE-2026-45513 and CVE-2026-57537 already shipped in earlier Galaxy updates, and that CVE-2026-57554 does not apply to its devices.

On top of that come four High-rated Samsung Semiconductor fixes (CVE-2026-35494, CVE-2026-68993, CVE-2026-69043 and CVE-2026-69044) and 27 Samsung Vulnerabilities and Exposures (SVE) items, Samsung's name for bugs in its own software. The bulletin describes only 13 of the 27 and says the rest "cannot be disclosed at this time". Of the 13, six are High and seven Moderate.

Coverage quotes 62, 76 and up to 83 fixes for this release. Our reading of the bulletin: 45 Google, 13 described SVE and 4 Semiconductor items make 62, and counting all 27 SVE items gives 76. We could not reproduce 83 from Samsung's page. The Semiconductor fixes are for Samsung's own Exynos chips, so Sammy Fans points out they do not apply to the S25, S25+ and S25 Ultra, which use Qualcomm's Snapdragon 8 Elite for Galaxy in every region.

How the Samsung-specific bugs work

The MediaTek modem bugs. The modem, or baseband, is the separate processor that runs the cellular radio. MediaTek describes CVE-2026-20519 as an out-of-bounds write in the modem caused by a missing bounds check: data from the network is copied past the end of a buffer. A phone that connects to a rogue base station, a fake cell tower the attacker controls, can be hit with no user interaction and no extra privileges, which is why it rates Critical. MediaTek's bulletin, published October 5, fixes 31 flaws (2 Critical, 9 High, 20 Medium) and names chips including the MT6991 and MT6993. These fixes matter only on Galaxy models built on MediaTek chips.

WSM use-after-free (CVE-2026-21120, SVE-2026-2881, High). A use-after-free happens when code keeps using memory after releasing it, so an attacker who refills that memory controls what the code reads next. Samsung says a local attacker could use this one to run code with system privilege.

Media and image parsers. Three bugs sit in libsimba.heifdec, Samsung's decoder for HEIF (High Efficiency Image File Format) photos: CVE-2026-21124 and CVE-2026-21125 (High) and CVE-2026-21126 (Moderate). Two more are in libsmkvextractor.so, the Matroska (MKV) video reader: CVE-2026-21114 (High) and CVE-2026-21116 (Moderate). Samsung also fixed CVE-2026-21122 in its text-to-speech library and CVE-2026-21115 in its FLAC audio decoder. All are out-of-bounds writes or missing input checks that a crafted file can trigger. Samsung rates every one as local, meaning the attacker must first get the file processed on the phone.

Locksettings (CVE-2026-21123, SVE-2026-3972, High). A "tied" profile is a work profile that unlocks with the device's own screen lock. Samsung says an attacker who already has root could reach tied-profile data before the first unlock after boot, when that data is meant to be out of reach. Root is a high bar, but it is what someone who has taken a lost phone and chained a second bug would have.

A smaller item, CVE-2026-21118 in DownloadProvider, gave a local attacker access to files in scoped storage, the per-app storage area Android walls off from other apps.

What attackers are doing

Nothing public. Samsung marks every described SVE item as privately disclosed and flags none as exploited, and MediaTek says it is not aware of exploitation of its October fixes. Neither vendor has published technical write-ups or indicators. A normal monthly deadline fits, with one exception: staff who travel or handle sensitive deals on MediaTek-based Galaxy phones, because the modem bugs need no click.

Rollout and compliance plan for Samsung's October 2026 SMR: S26 series and Z Fold 8 and Flip 8 already updating since late September, require now with a grace period; Galaxy S25 series rolling out from South Korea since October 19, require after about two weeks; other models keep the September value; pilot one phone to confirm the patch level date

What to do

Know where each model is

Samsung stages releases by model, country and carrier. Reported so far: the S26 series from late September and in the US and Canada by October 8 (S948U1UES4BZIG and S948WVLS4BZIG), the Z Fold 8, Fold 8 Ultra and Flip 8 in South Korea in early October, the Galaxy A18 4G in Southeast Asia from October 16 (A185GXXS1AZJ1), and the S25 series from October 19. That is roughly three weeks between the newest flagship and last year's.

On a phone, open Settings, Software update to install, then Settings, About phone, Software information. The Security software version line should read "SMR Oct-2026 Release 1", and the Android security patch level line shows the date your MDM (mobile device management) tool reads.

Set compliance rules per group

In Microsoft Intune, an Android Enterprise compliance policy has Minimum security patch level, which takes a date in YYYY-MM-DD format and marks older devices noncompliant. Install the update on one phone per model group first and copy the patch level date it reports into the rule, rather than assuming it. Then:

S26 series and the 2026 foldables: set the rule now, with a grace period of about 14 days before Conditional Access blocks work apps.
S25 series: set it once your MDM shows most of those phones on the October build, likely within about two weeks, since SamMobile and Sammy Fans expect other regions to follow Korea within days.
Everything else: keep the September value until the update appears for that model in your region.

Push it instead of waiting

If you license Knox E-FOTA, Samsung's enterprise firmware service, you can pick the firmware version for each model, force the install so users cannot postpone it, and schedule it outside working hours.

If a phone cannot update yet

There is no vendor workaround for any of these bugs. Prioritise MediaTek-based models held by high-risk staff, and swap the phone if the update has not reached that model. For the Locksettings issue, Intune's device restriction setting One lock for device and work profile set to Block makes users choose a separate work profile passcode, so the profile is no longer tied. Samsung has not said this blocks the bug; we suggest it as hardening, not a fix.

Checking for compromise

No indicators exist. The Locksettings and WSM bugs are most useful to someone who already has root or code on the device, so make sure your compliance policy blocks rooted devices and checks the Play Integrity verdict, and review any phone that failed those checks while unpatched.

Our safeguarding and hardening work sets up per-model compliance rules and firmware control like this, and our mobile penetration testing tests the apps and data your staff carry on their phones. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: Samsung Mobile Security, October 2026 SMR, Sammy Fans on the Galaxy S25 update, SamMobile on the Galaxy S25 update, Android Headlines on the Galaxy S25 update, SammyGuru on the Galaxy S25 update, Android Headlines on Samsung's October release notes, eSecurity Planet, Sammy Fans on the S26 in the US and Canada, Android Central on the S26 update, Sammy Fans on the Galaxy A18, SammyGuru on the Galaxy A18, GBHackers on MediaTek's October bulletin, Cyberpress on MediaTek's October bulletin, TechRadar on the Galaxy S25 chip, Samsung Knox E-FOTA, Microsoft Intune Android Enterprise compliance settings.