This vulnerability arises from improper input validation in the VC1 codec within libsavsvc.so on Samsung Mobile Devices. Specifically, it allows local attackers to perform out-of-bounds memory writes. The vulnerability is identified as CWE-20 and affects devices running software versions before the SMR Aug-2026 Release 1. The CVSS 4.0 base score is 5.1, indicating medium severity, with attack vector local and low privileges required. No known exploits are reported in the wild, and no vendor advisory or patch information is currently provided.

Successful exploitation could allow a local attacker to write out-of-bounds memory, which may lead to memory corruption and potentially impact device stability or security. However, the attack requires local access and low privileges, limiting the scope of impact. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Samsung Mobile advisories for updates. No specific mitigations are currently documented.