Technical impact
The vulnerability arises from the improper export of Android application components within the ImsSettings module before the Samsung Mobile Release 1 firmware in June 2026. This weakness allows a local attacker, who has the ability to interact with the device’s application stack, to trigger the module’s logging function. Triggering the logging function could lead to the generation of log entries containing sensitive contextual data, potentially exposing private user information or internal state details. The impact is therefore a local information disclosure rather than remote code execution or privilege escalation.
Affected Systems
Samsung Mobile Devices running firmware versions prior to the SMR Jun‑2026 Release 1 update are affected. The specific components involved are part of the ImsSettings application, which is deployed on Samsung’s Android‑based mobile devices.
Risk and Exploitability
The CVSS score of 4.8 indicates a low‑to‑moderate severity vulnerability. The EPSS score of approximately 0.00013 (< 1%) reflects a very low probability of exploitation. The issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation to date. The vulnerability is exploitable from the local context; an attacker would need physical or local access to the device to trigger the logging function. Given the lack of a remote attack vector, the immediate risk to systems without local compromise remains limited, though an attacker gaining local control could still potentially read the fabricated log output and glean sensitive information.
