This vulnerability arises from improper access control in the Samsung Camera application, enabling a local attacker to retrieve the device's location data. The primary impact is a privacy breach, where sensitive location information becomes available to an attacker who can access the device. The weakness corresponds to CWE‑284, where insecure permissions allow unauthorized data access.

Samsung Mobile devices running the Camera application version lower than 16.5.00.28 are affected. The issue is present in all releases of Samsung Camera before that build, regardless of device model or region.

The CVSS score of 5.1 indicates a medium severity level, and the vendor has not listed this vulnerability in the CISA KEV catalog. The likelihood of exploitation is uncertain due to the requirement of user interaction and the fact that the attacker must have local physical or acquaintance access to the target device. However, once the conditions are met, the attacker can obtain the device’s location data without additional privileges.