This vulnerability is due to improper input validation in the MPEG4 codec within the libsavsvc.so library on Samsung Mobile Devices. Specifically, it allows local attackers to perform out-of-bounds memory writes, which can cause memory corruption. The vulnerability is identified as CWE-20 (Improper Input Validation) and affects versions before the SMR Aug-2026 Release 1. The CVSS 4.0 base score is 5.1, indicating medium severity. No known exploits are reported in the wild, and no official remediation or patch information is currently available.

Local attackers can exploit this vulnerability to write out-of-bounds memory, which may lead to memory corruption. The exact impact depends on the context of exploitation but could potentially affect system stability or security. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should follow Samsung's security advisories and avoid executing untrusted local code that could trigger the vulnerability.