Improper input validation in the PACM component of Samsung Mobile Android builds prior to the SMR Feb-2026 Release 1 allows a physical attacker to supply crafted inputs that result in the execution of arbitrary system commands. The flaw maps to improper input validation and command injection weaknesses (CWE‑20, CWE‑78) and can lead to full compromise of the device, including data theft or further lateral movement. The impact is limited to devices that contain the affected firmware revisions.

The vulnerability affects Samsung Mobile Devices running Android 14.0 across a wide range of SMR releases up to the Feb‑2026 rollout, as well as Android 15.0 and 16.0 builds spanning multiple SMR collections. All devices distributed with these firmware versions before the February 2026 update are impacted.

The CVSS score of 7 indicates high severity, but the EPSS score of less than 1% shows that exploitation is currently unlikely; the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be physical access to the device, requiring the attacker to manipulate the PACM interface or supply inputs via a physical medium. While the exploit is not readily achievable over the network, the potential for complete system compromise means that any successful attack would be damaging.