This vulnerability arises from improper input validation in the VC1 codec component (libsavsvc.so) of Samsung Mobile Devices. Specifically, it allows local attackers to perform out-of-bounds memory writes, which can cause memory corruption. The issue is identified as CWE-20 (Improper Input Validation). It affects devices running software versions before the SMR Aug-2026 Release 1. The CVSS 4.0 base score is 5.1, indicating medium severity. There is no vendor advisory or patch information available at this time.

The vulnerability enables local attackers to write out-of-bounds memory, which may lead to memory corruption. This could potentially cause application crashes or other unintended behavior. There is no evidence of remote exploitation or privilege escalation in the provided data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor Samsung Mobile advisories for updates. No specific mitigation steps are provided by the vendor at this time.