Improper input validation in the MPEG4 codec component of the libraries, specifically libsavsvc.so, permits a local attacker to write outside the intended memory bounds. The vulnerability could corrupt data structures or influence program flow, potentially leading to crashes or arbitrary code execution. The weakness is an example of an unchecked memory write or buffer overflow stemming from insufficient input validation. The impact is local: only attackers who can execute code on the device are affected, but the consequences may extend to the stability and integrity of the device’s operating system or media processing services.

Samsung mobile devices that have not yet received the SMR Aug‑2026 Release 1 update. The firmware update includes a patched version of libsavsvc.so designed to eliminate the out‑of‑bounds write. Devices running earlier releases remain susceptible.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is presently available, but the lack of a known public exploit and absence from CISA’s KEV catalog suggest that the risk of exploitation at large scale is currently low. However, the vulnerability is locally exploitable, meaning that an attacker who gains execution privilege on the device—such as through a malicious application—is able to trigger the memory corruption. Given that the situation depends on local code execution, the probability of real‑world attacks is moderate, especially for users who install third‑party or unverified applications.