PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6527 Samsung CVE debrief

CVE-2016-6527 affects the SmartCall Activity component in Samsung’s Telecom application on Samsung Note devices running Android L (5.0/5.1) and M (6.0). A malformed serializable object can trigger a denial of service event such as a crash or reboot, and the CVE description also notes a possible privilege-impact outcome. NVD rates the issue HIGH with CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means exploitation requires local access and user interaction, but the potential impact is still significant. Samsung’s SMR-AUG-2016 advisory is the primary vendor reference cited in the NVD record.

Vendor
Samsung
Product
CVE-2016-6527
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Samsung mobile fleet administrators, enterprise mobility teams, incident responders, and users of affected Samsung Note devices running Android 5.0, 5.1, or 6.0 should care, especially if the Telecom/SmartCall component is present on managed endpoints.

Technical summary

The vulnerable surface is the SmartCall Activity component in Samsung’s Telecom application. The NVD record describes abuse of a malformed serializable object leading to crash/reboot behavior and possible privilege gain. NVD maps the issue to CWE-264 and lists affected Samsung mobile CPEs for versions 5.0, 5.1, and 6.0. The published CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a local, user-interaction-dependent issue with high impact if successfully triggered.

Defensive priority

High for any environment with affected Samsung Note devices; otherwise lower priority if those device/version combinations are not present.

Recommended defensive actions

  • Apply Samsung’s SMR-AUG-2016 update or any later firmware that includes the fix.
  • Inventory Samsung Note devices running Android 5.0, 5.1, or 6.0 and verify patch level immediately.
  • Use MDM or endpoint management to block or remediate outdated firmware on managed devices.
  • Monitor affected devices for unexpected crashes or reboot loops that could indicate exposure.
  • Where feasible, reduce exposure to untrusted inputs and workflows that may reach the Telecom/SmartCall path until patched.

Evidence notes

This debrief is based on the supplied NVD CVE record and its listed references. The NVD record identifies the SmartCall Activity component, the affected Samsung mobile CPE entries, the CVSS 3.0 vector, and the CWE mapping. Samsung’s SMR-AUG-2016 advisory is cited as the vendor advisory, while the oss-security mailing list post and SecurityFocus BID 92330 provide contemporaneous third-party corroboration. No exploit code, weaponized reproduction, or unsupported impact claims are included here.

Official resources

Publicly disclosed through standard CVE/NVD channels. The CVE was published on 2017-01-18, and the NVD record was later modified on 2026-05-13. The vendor advisory referenced by NVD points to Samsung’s SMR-AUG-2016 bulletin.