Locksettings, a component of Samsung mobile devices, contains an improper privilege management flaw that allows a local attacker with root privileges to read data belonging to a tied user profile before the device has ever been unlocked. This vulnerability does not provide a remote entry point and requires local root, but it enables the attacker to access confidential user information and potentially open other attack avenues. It is categorized under improper privilege management, exposing data confidentiality to privileged attackers.

All Samsung mobile devices running software prior to the SMR Oct-2026 Release 1 update are affected. Devices that have not installed the October 2026 security update remain vulnerable.

The CVSS score of 6.7 indicates a moderate risk. The EPSS score is < 1 %, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers must first obtain local root privileges, which limits the threat to a device with existing local compromise. Once root is achieved, the attacker can read tied profile data before the first unlock, potentially leading to user account compromise.