Samsung Members EUVD-2026-34809

Exploitation requires local access to the target Samsung Android device with at least low-privilege code execution, as confirmed by the CVSS 4.0 vector (AV:L/PR:L). Samsung Members must be installed on the device, which is the default state on Samsung Android handsets. No additional configuration, enabled features, or elevated permissions are required for the attacker (AT:N in the vector). Exploitation is strictly bounded by the local attack vector - remote unauthenticated exploitation is not possible per AV:L. User interaction is not required (UI:N), meaning the malicious activity launch can occur silently without any victim action beyond the attacker obtaining local code execution. Devices running Samsung Members 5.8.01.5 or later are not affected.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N indicates local access, low complexity, no additional attack preconditions, low privileges, and no user interaction required - a relatively permissive local attack profile. The component scores VC:N/VI:L/VA:H indicate no direct confidentiality breach on the vulnerable system, minor integrity impact, and high availability disruption to Samsung Members itself. EPSS data is not available in the provided intelligence, so statistical exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public POC is identified at time of analysis. Real-world priority is moderate: exploitation requires an attacker already present on the device (physical access or a malicious installed app), which significantly limits opportunistic mass exploitation. However, the ability to launch arbitrary activities under Samsung Members' privilege context creates a realistic privilege-chaining scenario on Samsung-branded Android devices. The absence of a formal CWE assignment leaves some ambiguity about the precise root cause, which should be confirmed against the vendor advisory.

A malicious application installed on the target Samsung Android device constructs a crafted intent or input payload targeting Samsung Members' unvalidated input handling. The malicious app passes this payload to Samsung Members, which - lacking proper validation - resolves and launches an attacker-controlled Android activity or loads an attacker-specified URL under Samsung Members' application privilege context. This could be chained to phish the device user via a privileged WebView, or to invoke privileged Samsung-platform activities inaccessible to normal apps. No public POC exists at time of analysis.