The flaw is an improper input validation in the cover‑image extraction routine of libsimba.heifdec.media.samsung.so. When a local attacker supplies a crafted HEIF file, the decoder can fail to validate parameters and may execute arbitrary code on the device. This flaw is a local code‑execution vulnerability that would allow the attacker to run code with the same privileges as the decoding process. The weakness maps to CWE‑20.

The vulnerability resides in Samsung Mobile Devices that ship with the libsimba.heifdec.media.samsung.so library older than the SMR Oct‑2026 Release 1. Vendors providing firmware prior to that release are affected. Specific product names are Samsung Mobile Devices; version information indicates any installation before the referenced SMR Oct‑2026 Release 1.

The CVSS score of 8.6 indicates high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation may not yet be widespread. The attack vector is local; a malicious user who can introduce a crafted HEIF file into the device – for example, via a photo gallery, messaging app, or media download – can trigger the flaw. If exploited successfully, the attacker could gain arbitrary code execution on the device, leading to complete compromise of data confidentiality, integrity, and availability.