This vulnerability (CWE-926) arises from improper export of Android application components in Samsung Mobile Visual Voicemail versions before 20.1.00.05. Due to this misconfiguration, local attackers with limited privileges can initiate phone calls without having the required permissions. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity. No official patch or remediation level has been published by the vendor yet, and no known exploits are reported in the wild.

Local attackers can exploit this vulnerability to initiate phone calls without proper permission, potentially leading to unauthorized call activity. The impact is limited by the requirement for local access and low privileges, and no further privilege escalation or remote exploitation is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected Visual Voicemail application and monitor for unusual call activity. Avoid granting unnecessary permissions to applications or users that could exploit this vulnerability.