Executive brief
A security vulnerability exists in Samsung mobile devices running Android 14, 15, and 16 within the IAFDService component. This flaw allows an attacker who already has basic access to the device to bypass security controls and use restricted administrative functions. If exploited, this could lead to unauthorized system changes or interference with device operations.
Technical details
An improper access control vulnerability exists in the Samsung IAFDService component. The flaw allows a local attacker with low-level privileges to bypass intended restrictions and interact with privileged APIs. According to the CVSS 4.0 vector, the exploit has high impact on integrity and availability but does not directly compromise confidentiality. The vulnerability is addressed in the Samsung Security Maintenance Release (SMR) for July 2026.
Affected products
- Samsung Mobile Devices (Android 14, 15, 16) Prior to SMR Jul-2026 Release 1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory