A vulnerability exists in the Samsung Mobile library lib_sag_ai_sound_sep_v2.00.so that allows local attackers to read and write memory locations outside of the intended bounds, a weakness classified as CWE-787 (Absolute Out‑of‑Bounds Read or Write) or CWE-788 (Relative Out‑of‑Bounds Access). The flaw permits an out‑of‑bounds memory access that can expose information or corrupt data held in memory, solely when the attacker has local device access.

Samsung Mobile Devices running a version of lib_sag_ai_sound_sep_v2.00.so that predates the SMR Oct‑2026 Release 1 security update are vulnerable. Devices that have not applied the October 2026 update remain affected.

The CVSS score is 4.8, reflecting moderate severity. The EPSS score is not available. The flaw is local in scope, requiring physical or local access to the device. There is no indication of exploitation in the CISA KEV catalog at this time. While direct remote exploitation is not possible, if an attacker with local privileges can trigger the out-of-bounds access, sensitive data could be read or the memory could be corrupted, potentially leading to device instability.