Improper access control in Samsung Galaxy Store permits a local attacker to create files under the application's privileged directories. This vulnerability, classified as CWE‑22, results in the ability to write arbitrary data or executable code in a location where the application holds elevated privileges. The impact includes potential compromise of the store application’s integrity and the risk of executing malicious payloads with the store’s permissions.

Affected versions are all Galaxy Store releases prior to 4.6.03.8. The information does not specify particular device models, regions, or additional contexts, so administrators should treat all installations of those versions as vulnerable until an update is applied.

Based on the description, the likely attack vector is local, requiring a foothold on the device to write files with the Galaxy Store’s privileges. This is inferred from the requirement for local access mentioned in the description. The CVSS score of 7.0 indicates a high severity level, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Given the severity and the possibility of privilege escalation within the app, a timely patch is recommended.