The vulnerability is located in the MediaBufferBase indexer setter of the TizenFX library, where a required bounds check was omitted, allowing an out‑of‑bounds write. The flaw permits a caller to supply an index that exceeds the size of the underlying array, corrupting adjacent memory. Such corruption can lead to application crashes, denial of service, or in the worst case, arbitrary code execution if the overwritten memory controls execution flow. This weakness is classified as an out‑of‑bounds write and improper validation of array index.

Samsung’s open‑source TizenFX library is affected. Version details are not specified in the advisory, so any release that includes the unpatched MediaBufferBase indexer is vulnerable. Users should check whether their TizenFX deployment contains the patches submitted in pull requests 7814 and 7815.

The CVSS score of 6.3 signals moderate severity. EPSS information is unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating limited or no known exploitation. Because the flaw requires exploitation of a locally executable TizenFX consumer, an attacker would need to run code with the same privileges as the application. The overall risk is medium until the appropriate patches are applied.