An attacker with local privileges can supply an arbitrary file name to the AODManager component in Samsung Mobile Devices. The handler writes the file using system-level privileges, allowing creation of files that can alter or replace critical system data. This flaw can lead to unauthorized modification of system files, root access, or persistence mechanisms, compromising confidentiality, integrity, and availability of the device at a system level.

The vulnerability affects Samsung Mobile Devices running the AODManager component prior to the SMR April 2026 Release 1 update. Any device model that includes the legacy AODManager code is potentially impacted until the official security patch is applied.

The CVSS score of 6.8 indicates a moderate severity; the lack of an EPSS value and absence from the CISA KEV catalog suggest current exploitation volatility is unclear but not negligible. The exploitation vector is local: an attacker must have privileged access on the device, such as a malicious app that has been granted device permissions. Once conditions are met, the flaw can be leveraged to create privileged files, potentially leading to full privilege escalation.