Heap-based buffer overflow in the KnoxVault trustlet present in Samsung Mobile Devices prior to SMR Sep‑2026 Release 1 allows local privileged attackers to execute arbitrary code with high-level trustlet privileges. Successful exploitation can compromise device integrity, confidentiality, and availability.

The flaw affects Samsung Mobile Devices that run releases prior to the SMR Sep‑2026 Release 1 firmware. No exact CPE identifiers are listed, but the CVE specifically mentions Samsung Mobile Devices as the affected vendor/product. Devices using newer firmware releases which include the updated KnoxVault trustlet are expected to be is a heap‑based buffer overflow located in the KnoxVault trustlet used by Samsung Mobile Devices. An attacker with local privileged access can trigger the overflow to gain arbitrary code execution, effectively elevating privileges on the device. This flaw aligns with CWE‑122, indicating an out‑of‑bounds read/write in the heap.

The CVSS score of 7.1 classifies this weakness as high‑severity, and although the EPSS score is 0.001 (<1%), the absence of a KEV listing suggests that widespread exploitation has not yet been observed. The likely attack vector is local privileged, meaning an attacker must already have privileged device access—such as physical possession or root privileges—to trigger the overflow. Once executed, the attacker can run arbitrary code with trustlet privileges, potentially leading to full system compromise. Given these factors, the risk remains significant for devices that have not yet applied the firmware update.