The flaw in CmcCore involves insufficient permission checks, enabling local attackers to invoke privileged APIs. This allows attackers to perform elevated operations such as reading, modifying or deleting sensitive data, altering system settings, or installing malware, thereby compromising the confidentiality, integrity, and availability of the device.

Samsung Mobile Devices running CmcCore versions before the SMR Oct‑2026 Release 1 are affected. Devices with earlier releases lack the permission‑enforcement patch.

The CVSS base score of 6.9 indicates a moderate risk. The issue is not listed in CISA KEV and the EPSS score is unavailable, so the likelihood of exploitation remains uncertain. The vulnerability requires local or physical access to the device, suggesting a local privilege‑escalation vector. Without a publicly available exploit, mitigation hinges on applying the vendor’s firmware update and monitoring for malicious app activity.