The vulnerability lies in the PackageManagerService of Samsung Mobile Devices, where insufficient verification of data authenticity allows a local attacker to alter the installation restriction of a specific application. The attacker can effectively elevate privileges at the device level by enabling or disabling installation controls for target apps, enabling the installation of rogue or unauthenticated applications and potentially bypassing security safeguards.

Samsung Mobile Devices that have not installed the SMR Mar-2026 Release 1 security patch. No specific version information is provided beyond the reference to the March 2026 release.;

With a CVSS score of 6.9, the vulnerability presents a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; attackers must have physical or local access to the device. No remote exploitation or widespread automated attacks are described, which mitigates the overall exposure, but operational security demands review of device firmware and settings.