This vulnerability arises from improper input validation in the Galaxy Store application, allowing a local attacker to execute arbitrary scripts. The weakness is characterized as an input validation fault, which can lead to unauthorized code execution and compromise the integrity of the affected device. The impact is limited to devices running an affected version of the Galaxy Store, as no remote or network-based exploitation path is described.

Samsung Mobile’s Galaxy Store application, specifically versions culminating in 4.6.02 and earlier. The issue is confined to installations of the Store prior to the 4.6.02 release, although the specific patch version that removes the flaw is not listed in the provided data.

The CVSS v3 score of 5.1 classifies the flaw as medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation. Because the attack requires local presence on the device, the scope is limited to users who can physically access or control the device. No indication exists that the vulnerability has been actively exploited in the wild or is listed in CISA’s Known Exploited Vulnerabilities catalog. Thus, the immediate risk to most users remains moderate, contingent upon the likelihood of local compromise.