This vulnerability arises from an incorrect conversion between numeric types in the VC1 codec within the libsavsvc.so library on Samsung Mobile Devices. The flaw permits local attackers to perform out-of-bounds memory writes, which could lead to undefined behavior or memory corruption. The vulnerability is identified as CWE-681 and has a CVSS 4.0 base score of 5.1, indicating medium severity. It affects devices running software versions prior to the SMR August 2026 Release 1. No vendor advisory or patch information is currently available.

Local attackers can exploit this vulnerability to write out-of-bounds memory, which may cause memory corruption or instability on affected Samsung Mobile Devices. The impact is limited by the requirement for local access and the absence of known remote exploitation or privilege escalation vectors. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply the SMR August 2026 Release 1 once available, as it is implied to address this issue. No additional vendor-provided mitigation instructions are currently available.