The vulnerability is an uncaught exception that is triggered when specially crafted or malformed input is processed by Samsung Open Source Vyond. The exception is not handled properly, which can cause the application to terminate or enter an invalid state, resulting in a loss of service availability.

All releases of Samsung Open Source Vyond built from source before the commit fb10a5c8b833df7f152d4a563a61d6090a1790d7 are affected. No specific version numbers are listed; any installation prior to this patch is considered vulnerable.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. The most probable attack path involves an attacker delivering malicious input to the application, either locally or via an exposed interface if the application accepts external data. Exploitation would primarily lead to service disruption rather than confidentiality or integrity compromise.