Improper input validation in the sheifd parser of Samsung’s libsimba.heifdec.media.samsung.so allows a local attacker to craft malicious HEIF files that trigger arbitrary code execution with the privileges of the process that loads the library. The core weakness is improper input validation (CWE-20). If exploited, the attacker could compromise the device’s confidentiality, integrity, and availability by gaining execution control over system components that rely on the library.

All Samsung Mobile Devices running software prior to the SMR Oct‑2026 Release 1 that include the vulnerable libsimba.heifdec.media.samsung.so. No specific version numbers were disclosed, but any device that has not applied the Oct‑2026 security update is potentially affected.

The CVSS score of 8.6 categorizes this issue as high severity, and although EPSS data is not provided, the lack of a known exploit in the KEV list suggests no widespread public exploitation has been observed yet. Based on the description, it is inferred that the vulnerability requires local access to supply a malformed HEIF file, meaning the primary attack vector is local. If an attacker can gain local file write or execution privileges, they could trigger the flaw by opening or processing a crafted image in any application that uses the decoder.