This vulnerability is a path traversal flaw in Android's ShortcutService that exists in firmware releases prior to the SMR Feb-2026 Release 1. A privileged local attacker can craft a shortcut that points to an arbitrary path, causing the system to create a file with system privileges. This can be leveraged to write malicious binaries or configuration files that persist with elevated privileges, potentially enabling further code execution or persistence on the device.

The flaw affects Samsung Mobile Devices running Android 14, Android 15, and Android 16 versions that have received service release or maintenance releases prior to SMR Feb‑2026 Release 1. The vulnerability is present in all build variants that include the unpatched ShortcutService component.

The CVSS score for this weakness is 6.8, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local privilege, meaning the attacker must already have privileged access to the device or be a local user with sufficient rights to create shortcuts. Despite the low exploitation probability, the impact remains significant due to the potential for persistent privilege escalation.