Improper input validation in the SecSettings component of Samsung Mobile’s Android OS, prior to the SMR Jan-2026 Release 1 update, allows a local attacker to read a privileged file. The flaw does not provide remote code execution but permits escalation to system-level privileges, enabling access to configuration data, credential storage, or other sensitive files. Attackers must have local access to the device and must trigger the vulnerability through user interaction.

The flaw affects Samsung Mobile Devices running Android 13.0, 14.0, 15.0, or 16.0 across a range of SMR updates from February 2021 through September 2025. Any device that has not yet received the SMR Jan-2026 Release 1 security update is vulnerable.

The CVSS v3 score is 2.3, indicating low impact, and the EPSS score is below 1 %, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and requires local tampering with user input, so exposure is limited to scenarios where an attacker can interact directly with the device. Consequently, the risk remains low but organisations should promptly apply the Jan‑2026 update to eliminate the vector.