Use‑after‑free occurs in the DualDAR component of Samsung Mobile Devices before the SMR Jan‑2026 Release 1 update. The flaw permits an attacker who already has local privileged access to run arbitrary code, potentially taking full control of the device. It is classified as CWE‑416 and could compromise confidentiality, integrity, and availability of the device.

Affected devices are Samsung Mobile Devices running Android 13 through Android 16 that include the DualDAR component. The weakness spans SMR updates released from December 2021 through September 2025 for Android 13–14, and corresponding series for Android 15–16 as well as future Android 15 and 16 updates until the SMR Jan‑2026 Release 1 patch is applied.

The CVSS score of 6.7 indicates a medium severity issue, while the EPSS score of less than 1 % shows a very low likelihood of exploitation. The flaw does not appear in the CISA KEV catalog, suggesting it has not been widely exploited in the wild. However, exploitation requires local privileged access, meaning any user or application that can gain root or system-level privileges on the device could use this vulnerability to execute arbitrary code. Consequently, the risk is moderate for devices that expose privileged user accounts and high for devices that allow installation of privileged applications without stringent checks.