The flaw in CmcCore centers on insufficient permission checks, allowing an attacker who has local or physical access to invoke privileged APIs. This can enable the attacker to read, modify, or delete sensitive data, alter system settings, or install malicious software, thereby compromising the confidentiality, integrity, and availability of the device.

Samsung Mobile Devices running CmcCore versions prior to SMR Oct‑2026 Release 1 are affected. Devices shipped with earlier releases lack the permission‑enforcement patch.

The CVSS base score of 6.9 indicates a moderate risk. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is local, requiring physical or local access to the device. With no publicly available exploit at this time, the primary mitigation is to apply the vendor’s firmware update or, if unavailable, to limit usage of the vulnerable APIs by restricting application privileges.