The vulnerability resides in the subtitle frame loading routine of libsubextractor.so. Because the input is not properly validated, a crafted subtitle file can cause the library to write data beyond the bounds of the allocated buffer, leading to corruption of adjacent memory structures. This can potentially allow a local attacker to corrupt program state, crash the application, or, in a worst‑case scenario, overwrite control data that could be exploited for further malicious activity.

Affected devices are Samsung Mobile Devices running Android 14 through Android 17 that include the libsubextractor.so component. The flaw is present in releases prior to SMR Sep‑2026 Release 1, which is the point of fix. Devices that have not applied the latest firmware update incorporating this fix are vulnerable.

The CVSS score of 6.9 denotes a moderate severity issue. EPSS < 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. The attack requires local privilege, meaning the adversary must be able to run code on the device, typically by delivering a malicious subtitle file through a legitimate media application. While the risk is moderate, the potential for memory corruption warrants timely mitigation.