GalaxyDiagnostics for Samsung Mobile devices contains an improper input validation flaw that permits a local attacker with sufficient privileges to provide crafted data and trigger the execution of any privileged command. The flaw is present in all releases before version 3.5.050. This flaw could allow the attacker to take full control of the device or execute commands that affect system integrity.

The affected product is Samsung Mobile’s GalaxyDiagnostics application; all versions released prior to 3.5.050 are vulnerable. Users running those versions on Samsung Galaxy phones remain at risk until the software is updated or removed.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild at this time. Because the vulnerability requires local privileged access, the attack surface is limited to devices already in the control of a privileged user or compromised by other means. The flaw is not listed in the CISA KEV catalog, implying no publicly known exploits yet. The likely attack vector is local privileged access.