Jwt Attack EUVD-2026-12295

The CVSS v4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) indicates a physical attack vector with low complexity, no attack time requirement, and no privilege requirement, but mandatory user interaction. The severity is constrained to high integrity impact with no confidentiality or availability impact. Real-world risk is moderate because physical access is required; however, the low attack complexity and user interaction requirement (not automatic) make this practically exploitable in scenarios where an attacker has temporary device possession. Without confirmation of EPSS data, KEV listing status, or public proof-of-concept availability, the threat level should be assessed as moderate-to-low for most users, but higher for high-value targets, corporate environments, or supply-chain contexts where physical device access may be plausible. This is not a network-exploitable vulnerability and does not enable unauthorized access or data exfiltration by itself.

An attacker with brief physical access to a Samsung device (e.g., in a public space or shared environment) prompts or manipulates the user into accessing Font Settings and installing a custom font file. The attacker has pre-crafted a malicious font file that contains embedded scripts or exploits or is designed to disrupt visual rendering; because the signature verification is improper, the font installs despite not being signed by Samsung. Once installed, the font modifies the system rendering stack, potentially enabling secondary attack chains or denial of service. While this requires user interaction and physical presence, it remains feasible in social engineering or insider scenarios.