An out‑of‑bounds write flaw exists in the libsmkvextractor.so component of Samsung Mobile Devices, allowing a local attacker to overwrite memory beyond the intended buffer boundaries. This overrun can corrupt program state, potentially leading to application crashes or providing a foothold for additional exploitation. The weakness is identified as a buffer overflow (CWE‑787).

Samsung Mobile Devices that incorporate the libsmkvextractor.so library are affected. No specific firmware or OS version limits are listed, but the flaw exists in all builds prior to SMR Oct‑2026 Release 1, which introduces the patched implementation.

The CVSS score of 5.1 indicates a moderate severity vulnerability with a medium potential for impact. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring an attacker to execute code or move laterally on the device to trigger the out‑of‑bounds write. If abused, the flaw could compromise application integrity, causing crashes or enabling further attacks that elevate privileges or corrupt data.