This vulnerability arises from improper exporting of Android application components in the SpriteWallpaper app, allowing an attacker who gains local access to the device to retrieve sensitive information. The flaw is a classic information‑exposure weakness and does not provide remote code execution or denial of service capabilities, but it gives an attacker direct insight into data that should be confined to the app's protected environment.

Samsung Mobile Devices running any version of the SpriteWallpaper application prior to the SMR Jun‑2026 Release 1 update are affected. The issue is limited to that specific app component export configuration and does not extend to other Samsung mobile software.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of < 1% suggests a low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access to the device to exploit this flaw, most likely through a previously installed app or physical access. No additional network prerequisites or privilege escalations are described, so the attack vector is local and requires user interaction or pre-existing malicious code on the device.