An improper verification of the cryptographic signature for fonts in the Android 16.0 font settings was discovered. The flaw exists in versions released before the SMR Mar‑2026 Release 1 update. A physical attacker who can install a custom font on the device can bypass signature checks, potentially allowing local code execution or other unauthorized actions. CWE‑347 is cited for this improper signature validation weakness.

The vulnerability affects Samsung Mobile Devices running Android 16.0, including all the Software Maintenance Releases (SMRs) listed in the CPE entries (SMR Aug‑2025 r1 through SMR Mar‑2026 r1). Devices on any of these firmware levels are susceptible until a patch is applied.

The CVSS score is 5.1 (Medium), and the EPSS probability is reported as less than 1 %, indicating a low likelihood of exploitation. The issue is not yet listed in the CISA KEV catalog, further suggesting it is not actively exploited in the wild today. The primary attack vector is physical access, which limits exposure to individuals who can physically interact with the device. Nevertheless, the potential for local privilege escalation warrants prompt remediation.