The vulnerability is an out‑of‑bounds write in libcodec2-sec-flacdec.so, which allows a local attacker to overwrite memory adjacent to a buffer. This flaw can corrupt internal data structures or, based on the description, it is inferred that it could lead to arbitrary code execution if the corrupted memory affects a critical component. The weakness is a classic buffer overflow and does not depend on network or remote input, requiring local access to the device.

Samsung Mobile Devices are affected. The flaw was found in the libcodec2-sec-flacdec.so library bundled with the Samsung Mobile firmware as of the Oct‑2026 Release 1. No specific device models or OS versions are listed, but the issue applies to all Samsung Mobile Products that ship with the vulnerable library version.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is local, so exploitation requires physical or local access to the device. Since the flaw enables out‑of‑bounds memory writes, an attacker could potentially crash the application or gain malicious control over the execution flow if the overflow reaches a privileged context. No public exploit has been reported, but the lack of a patch means the only mitigation is to install future updates once Samsung releases a fix.