Galaxy Store EUVD-2026-12321

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) indicates local attack vector with low complexity but temporal persistence required, no privilege requirement, no user interaction needed, and high integrity impact. The moderate base score of 5.9 contrasts notably with the high integrity impact rating, suggesting this metric reflects the localized attack surface. The attack requires physical access or local account access (AT:P temporal factor), which reduces the exploitability in many scenarios. However, the lack of privilege requirement and no user interaction needed means any local user can exploit this. While no public CVSS EPSS probability or CISA KEV status is provided in the source data, the vulnerability's nature (cryptographic bypass) typically indicates high exploitability once weaponized. The primary limiting factor is the local-only attack vector, which constrains blast radius compared to network-exploitable flaws. This is a priority for device manufacturers and enterprise mobile device management solutions, but represents lower urgency for users without local attackers on their networks.

An attacker with local access to an unlocked Samsung device identifies the improper signature verification in Galaxy Store and crafts a malicious application package with a forged or missing signature. The attacker transfers the malicious APK to the device via USB, removable storage, or local file system manipulation and uses Galaxy Store's installation interface to install the package. Because Galaxy Store fails to validate the cryptographic signature properly, the malicious application installs successfully despite lacking valid authorization credentials, allowing the attacker to execute arbitrary code with application-level privileges on the device. This scenario requires physical presence or prior local account compromise but no social engineering or user interaction beyond normal installation workflows.