Improper input validation in the FacAtFunction of Galaxy Watch devices prior to the SMR May‑2026 Release 1 allows a local attacker to execute arbitrary code with system privileges. The flaw enables an attacker to inject or manipulate input that is passed to the system without sanitization, resulting in uncontrolled code execution. This directly compromises the confidentiality, integrity, and availability of the device, potentially granting an attacker full control over the watch.

Samsung Mobile Devices, specifically Galaxy Watch models running firmware versions before the SMR May‑2026 Release 1 update. No specific model number or version list is provided, but any device not yet updated to the referenced release is affected.

The CVSS score of 8.9 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, suggesting that exploit data is currently unknown. Because the exploit requires local access to the device or the ability to inject input into the FacAtFunction, the attack vector is likely local, though physical access or pre‑compromised connectivity could also be used. Given the high severity and the potential for complete system takeover, the risk to affected users is significant.