An input validation flaw in Samsung's libsimba.heifdec.media.samsung.so library causes local attackers to write beyond array bounds when processing cover images. This out‑of‑bounds write can corrupt critical memory, potentially leading to crashes, data loss, and, if an attacker can control the corrupted data, arbitrary code execution on the device.

Samsung Mobile Devices are affected, as the vulnerability resides in the HEIF decoder library shipped with Samsung mobile firmware. No specific firmware versions are listed in the advisories, so all devices using the SMR Oct‑2026 Release 1 or earlier may be vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. Because the flaw requires local access, the attack vector is largely restricted to individuals with physical possession of the device. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Nonetheless, the potential for memory corruption warrants timely mitigation.