Improper handling of insufficient permissions in the Routines component of Samsung Mobile devices allows local attackers to read sensitive information. This weakness enables an attacker who can execute code locally or interact with routine functions to bypass the expected permission checks and access data that should be restricted. The vulnerability directly affects confidentiality by exposing personal or system data to unauthorized parties without modifying system state, and the impact is confined to users with local access to the device or the routine environment.

Samsung Mobile Devices operated with firmware versions older than SMR May-2026 Release 1. Devices running Routines prior to this release are impacted; newer releases are not affected as the permission handling flaw is corrected. No additional vendor or product versions are identified in the current advisory.

The CVSS score of 6.9 indicates a moderate severity for local attackers, aligning with a Medium overall risk. EPSS score is <1%, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. Nevertheless, local actors could exploit the flaw by executing malicious routines or using privileged apps, making timely remediation advisable. The attack vector is inferred to be local, requiring direct interaction with the device or routine module.