Samsung Flow EUVD-2026-97198

Exploitation requires the attacker to be on an adjacent network (AV:A) - within Bluetooth, Wi-Fi Direct, or the same local wireless segment used by Samsung Flow to link a Galaxy phone with a paired PC or tablet - and to satisfy a specific attack requirement (AT:P in the 4.0 vector), implying exploitation is not reliably repeatable on demand and likely depends on timing or an in-progress pairing/connection state. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the victim must be actively running Samsung Flow on a vulnerable build (< 4.9.22.4), the attacker must be in physical/network proximity, and the conditional attack requirement reduces the probability of a successful single attempt - all of which constrain realistic exploitation well below what the network-less CVSS base might suggest.

This is a moderate-severity information-disclosure flaw whose real-world risk is meaningfully constrained by its attack vector, not a drop-everything priority. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) confirms the attacker needs adjacent-network access (same Wi-Fi/Bluetooth/Wi-Fi Direct proximity) rather than remote internet reach, and the AT:P metric indicates a specific attack requirement must be met, which lowers automatability and mass-exploitation potential. On the impact side the vector claims high confidentiality (VC:H) with only low integrity/availability (VI:L/VA:L), consistent with the description's focus on accessing sensitive information. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - signals all point to a vendor-discovered, self-reported issue (reporter mobile.security@samsung.com) rather than an in-the-wild threat. One discrepancy to verify: the vendor vector asserts low integrity and availability impact, but the description mentions only information access (confidentiality), so the I/A impact ratings are not substantiated by the prose and should be confirmed with Samsung's bulletin. Net: patch in normal cycles; the adjacency requirement and absence of exploitation signals make this a managed-risk item rather than an emergency.

An attacker within Bluetooth, Wi-Fi Direct, or shared local-network range of a victim running Samsung Flow abuses the improper authentication in the device pairing/connection handshake to impersonate or interpose on the trusted link between the phone and its paired PC or tablet. Having defeated the authentication check, the attacker reads sensitive data (such as notifications, clipboard, or transferred content) flowing over the Samsung Flow channel. No public exploit code was identified in the provided intelligence, and exploitation requires physical/network proximity to the target.