The vulnerability is an incorrect default permission setting in Samsung Flow that allows a local user to start an arbitrary activity with the app’s full privileges. Based on the description, it is inferred that launching such an activity could allow the attacker to exercise the app’s permissions beyond normal user capabilities. Based on the description, the impact is a local privilege escalation that could facilitate further malicious actions by leveraging the app’s granted permissions.

Samsung Flow for Android, any installation prior to version 4.9.22.4 is affected. The vulnerability originates from the default permission configuration within the app, and the CVE description does not specify device model constraints; therefore it is inferred that the issue could affect any device running the vulnerable Flow release. No other vendors or products are listed as impacted.

The CVSS score of 2.1 indicates a low severity. Since the EPSS score is not available, the likelihood of exploitation remains unknown. The CVE is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the description, the attack vector is local: a local user must invoke the vulnerable activity. The technical barrier appears low, but the lack of exploitation data suggests limited real‑world impact at present.