An Android application component in the Galaxy Editing Service was improperly exported before the SMR Jun‑2026 Release 1 update, allowing a local attacker with device access to invoke privileged operations. Based on the description, the attacker can execute actions that normally require higher system permissions, which may lead to changes in system state or access to restricted resources, but specific confidentiality or integrity impacts are not detailed in the advisory.

Samsung Mobile Device users running the Galaxy Editing Service prior to the SMR Jun‑2026 Release 1 are affected. No further versioning information is provided beyond the pre‑release identifier; all devices that have not applied the Jun‑2026 update remain vulnerable.

With a CVSS score of 6.8 this vulnerability is considered medium severity. The EPSS score is < 1% and the exploit is not listed in CISA KEV. The likely attack vector is local, requiring the adversary to be on or physically access the device. The low EPSS probability indicates that exploitation is uncommon, but the possibility of local privilege escalation still makes this risk significant for devices that have not applied the latest security update.