EUVD-2026-74646
GHSA-x547-pw25-c5jh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector, no privileges or interaction required; confidentiality-only impact consistent with information disclosure from an unprotected exported Android component.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information.
AnalysisAI
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that: (1) the attacker can install and execute a local Android application on the target Samsung device (either via physical access, social engineering to sideload an APK, or a co-installed malicious app); (2) the target device runs Android 15 with Collection < 1.0.1.14, or Android 16 with Collection < 2.0.02.7; (3) the AT:P precondition is met - likely that the Collection app is installed and its data store is populated with user content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Collection 1.0.1.14 for Android 15 and 2.0.02.7 for Android 16. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today