This vulnerability involves improper input validation in the Samsung Contacts application on Samsung Mobile Devices. It enables physical attackers to bypass expected access controls and access data belonging to multiple user profiles. The issue is identified as CWE-20 (Improper Input Validation). The vulnerability is present in versions prior to the SMR Aug-2026 Release 1, but exact version numbers are not specified. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized physical attackers to access data across multiple user profiles on affected Samsung Mobile Devices. This could lead to unauthorized disclosure of sensitive user information. The CVSS 4.0 vector indicates the attack requires physical access (AV:P), low attack complexity (AC:L), no privileges or user interaction, but has high impact on confidentiality and security scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Samsung's security advisories for updates. Until a fix is available, limiting physical access to devices and using device-level protections may reduce risk.