A path‑traversal flaw exists in Samsung Mobile’s SemClipboardService that allows a locally privileged user to craft requests resolving to arbitrary file paths. This vulnerability can enable the attacker to read or modify files protected by system privileges, thereby compromising confidentiality and integrity of critical device data. While it does not provide direct remote code execution, the ability to access sensitive files could be leveraged to facilitate further privilege escalation or data exfiltration if other weaknesses are present.

Samsung Mobile Devices running firmware versions prior to SMR Jul‑2026 Release 1, which include the unpatched SemClipboardService, are affected.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of <1 % combined with its absence from CISA’s KEV catalog suggests that exploitation activity is limited. The attack vector is local; an attacker must have user‑level access to trigger the path‑traversal. Because the flaw does not allow remote exploitation and requires local privileged execution, the overall risk for immediate compromise remains low, though attentive monitoring is advised.