Locksettings, a component of Samsung mobile devices, contains an improper privilege management flaw that allows a local attacker with root privileges to read data belonging to a tied user profile before the device has ever been unlocked. The vulnerability does not provide a remote entry point and requires local root, but it enables the attacker to access confidential user information and potentially reopen other attack avenues. It is categorized under improper privilege management, exposing data confidentiality to privileged attackers.

All Samsung mobile devices running software prior to the SMR Oct-2026 Release 1 update are affected. Devices that have not installed the October 2026 security update remain vulnerable.

The CVSS score of 6.7 indicates a moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers must first obtain local root privileges, which limits the threat to a device with existing local compromise. Once root is achieved, the attacker can read tied profile data before the first unlock, potentially leading to user account compromise.