Samsung Mobile Devices EUVD-2026-12299

The CVSS v4.0 vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N indicates a locally exploitable vulnerability requiring high privileges and presenting high integrity impact. The attack vector is Local (AV:L), meaning an attacker must already have account access on the target system; Attack Complexity is Low, signifying straightforward exploitation; and crucially, PR:H (high privileges required) significantly restricts the threat population to administrators and privileged service accounts. The integrity impact (VI:H) indicates unauthorized modification of ThemeManager state or trial content, but confidentiality and availability are unaffected. Notably, this CVE is absent from CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild. Without disclosed EPSS probability data in the record, the real-world exploitation likelihood appears moderate at best, constrained by the requirement for high local privilege. This is a priority for organizations running ThemeManager in multi-user or cloud environments where privilege escalation or insider threats are concerns, but not an emergency for single-user or tightly controlled deployments.

An administrator or privileged service account with legitimate access to a ThemeManager instance intentionally or inadvertently exploits the privilege management flaw to reuse expired trial theme content beyond its intended license period, effectively extending trial functionality indefinitely or redistributing trial-restricted themes to unauthorized users. Since the attack vector is Local and requires High Privilege, this scenario is most realistic in insider threat contexts—for example, a disgruntled IT administrator circumventing license restrictions—or in scenarios where a privileged account is compromised via phishing or lateral movement following an initial breach. The Low Attack Complexity suggests the attacker need not craft sophisticated payloads; standard ThemeManager API calls or administrative interfaces would suffice to trigger the reuse logic.