Galaxy A57 Is First to Get Samsung's September Patch, With 18 Critical Fixes

Samsung has started pushing its September 2026 Security Maintenance Release, and the Galaxy A57 is the first phone in the company's A series to get it. The build is A576BXXS6AZI3, it weighs in at roughly 500MB, and it is landing first in India, Nepal, Bangladesh and Sri Lanka.

This is a security-only release. It does not carry One UI 9, and it does not add features. What it does carry is a larger batch of fixes than a typical month.

What is actually inside the September patch

Coverage of this rollout has described it loosely as fixing "90 vulnerabilities", but Samsung's own September bulletin is more precise, and the breakdown is worth knowing because it tells you how urgent the update is.

• 44 CVEs inherited from Google's Android bulletin — 18 rated critical, 26 rated high.
• One high-severity Samsung Semiconductor CVE, tracked as CVE-2026-48173.
• 31 Samsung Vulnerabilities and Exposures (SVE) items — 2 critical, 17 high, 12 moderate. These are Samsung-specific bugs that Google's bulletin never covers.

The two critical SVE entries are the ones that justify installing this promptly. Both are heap-based buffer overflows in image decoding code (SVE-2026-3247 and SVE-2026-3282) that can lead to remote code execution — the class of bug where simply receiving and rendering a malformed image is enough. A third high-severity item, SVE-2026-3314, is a buffer overflow in the KnoxVault trustlet, which runs in a privileged context.

Samsung's bulletin covers devices across Android 14 through Android 17, so the underlying fixes are not exclusive to the A57. That handset is simply first in the queue.

Where the update is live, and where it is not

Right now this is a South Asia rollout. India, Nepal, Bangladesh and Sri Lanka are the confirmed markets. Samsung releases firmware in waves keyed to region and CSC (the carrier or country code baked into your device), so European, Middle Eastern and Latin American A57 units will see the same patch level over the following days and weeks rather than today.

If you are in one of the launch markets and the update has not appeared, that is normal — the server-side rollout is staggered, and forcing it is not possible.

How to check on your own phone

Open Settings, scroll to Software update, then tap Download and install. If the update is available for your CSC, it will appear there. Plug in or charge above 50 percent first, since a 500MB firmware install reboots the device and takes several minutes.

To confirm you already have it, go to Settings > About phone > Software information and look at two lines: the build number should end in AZI3, and the Android security patch level should read September 2026.

One UI 9 is a separate wait

It is easy to conflate the two, so to be clear: this patch is built on One UI 8.5, not One UI 9. The A57 is currently on the second One UI 9 beta, and Samsung has not yet shipped stable One UI 9 even to the Galaxy S26 flagship line. A stable One UI 9 build for the A57 this month is not realistic. Owners tracking that release should follow the beta programme separately — we covered how the A-series beta rollout started with the Galaxy A35 in Korea, and the flagship track in our look at One UI 9 beta 6 on the Galaxy S26.

For comparison, Google shipped its own September-cycle fixes to Pixel hardware on a different schedule, which we broke down in our coverage of the Android 17 Pixel update.

Should you install it now

Yes, but there is no need to panic. There is no public evidence that the two critical image-decoder bugs are being exploited in the wild, and Samsung's bulletin does not flag any of this month's items as actively attacked. The reason to move quickly is simply that image-parsing flaws are attractive targets once the patch details are public, and the fix costs you five minutes.