The vulnerability is an array index validation flaw that can lead to input data manipulation. An attacker can supply data that causes the program to access an array outside its bounds, potentially corrupting memory or corrupting application state. The impact is primarily on data integrity; incorrect data could alter the behavior of the application or enable further exploitation. The weakness is classified as CWE-129, improper validation of array index.

Samsung Open Source Vyond, any version before commit be6e297b0c4836e20d73b2f8a40a561ea496ebaa. No other vendors are listed. The affected product is the Samsung Vyond package released as part of the Samsung Open Source project.

The CVSS score of 4.4 denotes a moderate severity. The EPSS score of less than 1% indicates a very low probability that exploitation is currently occurring, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through user-supplied input that is processed by Vyond, so an attacker could craft data that triggers out‑of‑bounds access. However, because the CVE description does not specify the network exposure, it is uncertain whether the flaw is exploitable remotely. Nonetheless, the presence of an array index validation flaw warrants remediation.