Improper verification of the cryptographic signature used by Samsung’s Galaxy Store before version 4.6.03.8 permits a local attacker to bypass security checks and install any application of their choosing. The flaw effectively removes the integrity guarantee of the application installation process, allowing malicious code to be trusted by the device. The vulnerability is a classic example of insufficient signature validation, enabling unauthorized code execution.

Samsung Mobile Galaxy Store is the affected product. Devices running the Galaxy Store application prior to version 4.6.03.8 are at risk. No additional vendor or version information is provided beyond the indicated store component.

The CVSS score of 5.9 indicates a moderate overall risk, while the EPSS score of less than 1 percent suggests a low probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires local access to the device, the attack vector is likely local, meaning an attacker must be physically present or already have privileged access. The lack of an exploit probability combined with the moderate severity suggests that while the vulnerability is non‑critical, it can be dangerous if an attacker gains local device access.