Improper input validation in device routines before the SMR May-2026 Release 1 allows a physical attacker to supply crafted input that bypasses validation and triggers privileged execution. The flaw can be used to elevate privileges on the device, granting the attacker unauthorized access to features or data that require higher privileges.

Samsung Mobile Devices running firmware releases older than SMR May-2026 Release 1 are affected. No specific model or firmware version enumeration is provided, so any device prior to that release is potentially vulnerable.

The vulnerability carries a CVSS score of 5.1, indicating medium severity. An EPSS score of < 1% shows a very low probability of exploitation, and it is not listed in the CISA KEV catalog, suggesting no known active exploitation. The issue requires the attacker to be in physical proximity to the device to deliver the malicious input, making it a target-specific threat rather than a remotely exploitable flaw.