Samsung Camera application contains an improper access control flaw that permits a local attacker to read the device’s location data. The vulnerability allows disclosure of sensitive geographic information, which could be used for privacy invasion or targeted attacks. The weakness stems from insufficient permission checks when accessing location services, enabling unauthorized read access.

Samsung Mobile devices with the Camera app version earlier than 16.5.00.28 are affected. This covers all models running any build of Samsung Camera before that update, regardless of region or release date.

The CVSS score of 5.1 indicates a medium severity. The EPSS score of <1% shows the likelihood of exploitation is very low. Samsung has not listed this issue in CISA’s KEV database. Because the vulnerability requires the attacker to be on the device and to engage the user, exploitation in the wild is unlikely, though an attacker with physical or personal access could still obtain location data once the condition is met.