PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4546 Samsung CVE debrief

CVE-2016-4546 is a Samsung Android vulnerability affecting devices running Android 4.4, 5.0, or 5.1. According to NVD, a local user can trigger crafted data in a service call that causes the IAndroidShm service to crash, resulting in denial of service. The issue is rated medium severity and maps to CWE-20 (improper input validation).

Vendor
Samsung
Product
CVE-2016-4546
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Samsung mobile fleet administrators, endpoint/security teams managing Android 4.4/5.0/5.1 devices, and anyone responsible for controlling local-app risk on affected Samsung phones or tablets.

Technical summary

NVD describes the flaw as a local denial-of-service condition in Samsung's IAndroidShm service on Android KK (4.4) and L (5.0/5.1). The attack requires local access with low privileges and no user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates availability impact only, consistent with a service crash rather than data theft or code execution. NVD classifies the weakness as CWE-20.

Defensive priority

Medium. Prioritize remediation if you still manage supported Samsung devices on the affected Android branches, especially where untrusted or third-party apps can be installed. The issue is local and availability-focused, but it can still disrupt device functionality.

Recommended defensive actions

  • Check whether any Samsung devices in your environment run Android 4.4, 5.0, or 5.1 and confirm whether they are covered by Samsung security maintenance releases.
  • Apply Samsung vendor updates or firmware that address this issue, using the Samsung security maintenance release guidance referenced in the advisory link.
  • If devices cannot be updated, reduce local-app exposure by tightening app installation controls and removing untrusted software where possible.
  • Watch for repeated IAndroidShm service crashes or unexplained availability issues on affected devices.
  • Retire or replace unsupported devices that can no longer receive security updates.

Evidence notes

This debrief is based on the NVD CVE record and its listed references. NVD identifies Samsung mobile OS CPEs for Android 4.4, 5.0, and 5.1 as vulnerable, gives a local low-privilege CVSS 3.0 vector, and lists CWE-20. The source references include a Samsung vendor advisory page and an oss-security mailing list post. No CISA KEV record is associated with this CVE in the supplied data.

Official resources

Published in the NVD/CVE record on 2017-02-13. The supplied references include a Samsung advisory link and an oss-security post dated 2016-05-06, but those reference dates should not be treated as the CVE publication date.