The vulnerability originates from improper input validation in the FacAtFunction component before SMR Feb‑2026 Release 1. It permits a privileged physical attacker to inject and run arbitrary system commands on the device, effectively gaining full system control.

Samsung Mobile Devices running Android 14.0, 15.0, and 16.0, including the seasonal releases listed in the CPE data from SMR Apr‑2022 through Sep‑2026.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires a physical attacker with device‑level privileges; if such conditions exist, exploitation could lead to complete system compromise. The vulnerability is exploitable via local input injection into the FacAtFunction interface.