EUVD-2026-12317Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local system access
-
ExploitExploit improper access control in Galaxy Store
-
ExecutionCreate file with elevated Galaxy Store privilege
-
ImpactEscalate local privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local access to device running Galaxy Store versions prior to 4.6.03.8. No authentication or special configuration required; vulnerability exists in default installation. |
| Impact | Despite the high CVSS 7.0 score, the real-world exploitability is limited by the local attack vector (AV:L) which requires the attacker to already have access to the device. The attack complexity is low (AC:L) and requires no privileges (PR:N) or user interaction (UI:N), making it straightforward to exploit once local access is obtained. The impact is primarily on integrity (VI:H) with some availability impact (VA:L), while confidentiality remains unaffected (VC:N). Without EPSS data, KEV listing, or known POCs, this appears to be a moderate priority issue primarily concerning enterprise environments with shared devices or scenarios where malicious apps could exploit this locally. |
| Exploit ScenarioDerived | An attacker with local access to a Samsung device (either physical access or through a malicious app) could exploit this vulnerability to create files with Galaxy Store's elevated privileges, potentially modifying system configurations or installing unauthorized components. The attack requires no user interaction and minimal technical skill once local access is achieved. This could be particularly concerning in scenarios where a malicious app leverages this vulnerability to escalate its capabilities beyond its declared permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Galaxy Store versions prior to 4.6.03.8 contain an access control flaw that enables local attackers to create files with elevated Galaxy Store privileges. This vulnerability affects local users on affected devices and could allow privilege escalation or persistence mechanisms. No patch is currently available.
RemediationAI
Update Samsung Galaxy Store to version 4.6.03.8 or later through the Galaxy Store app settings or via Samsung's automatic update mechanism. For devices that cannot be immediately updated, restrict local access to trusted users only and avoid installing applications from untrusted sources. Enterprise administrators should prioritize updates for shared or kiosk devices where local access control is more difficult to maintain. Monitor Samsung's security bulletins for any additional guidance or patches related to this vulnerability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper access control mechanisms within Samsung's Galaxy Store application, which is the official app marketplace for Samsung Galaxy devices. While no specific CWE classification is provided, the issue allows local attackers to bypass intended security boundaries and create files with the elevated privileges of the Galaxy Store process. This type of vulnerability typically occurs when applications fail to properly validate or restrict file operations, allowing unprivileged processes to leverage the app's permissions for malicious purposes.
Know when Galaxy Store gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
Executive ViewAI
Samsung Galaxy Store versions prior to 4.6.03.8 contain a local privilege escalation vulnerability that could allow malicious applications or users with device access to gain elevated permissions and modify system files. This poses a direct threat to organizational devices, particularly those used by employees or in shared environments where untrusted applications may be installed.
Implement MDM policies to prevent installation of untrusted applications; disable Galaxy Store on corporate devices if not operationally required; enforce app whitelisting to prevent malicious application execution; segment mobile devices on separate network VLANs with restricted system file access; monitor for suspicious file creation activity on affected devices; educate users against sideloading applications and installing from non-official stores.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Samsung Galaxy Store Access Control Issues
View all 3More in Galaxy Store
View allImproper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute Ja
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 al
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execu
Galaxy Store versions up to 4.6.02 contains a vulnerability that allows attackers to execute arbitrary script (CVSS 7.8)
Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applic
Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows loca
Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a
Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a
Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications
Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute
Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protecte
GitHub PoC
Exploit-DB