Samsung Mobile Improper Input Validation Vulnerability in FacAtFunction Allowing Arbitrary Command Execution

A vulnerability exists in Samsung Mobile devices running Android versions 14, 15, and 16, prior to the February 2026 Security Maintenance Release. The issue stems from improper input validation in the FacAtFunction, which allows a privileged physical attacker to execute arbitrary commands with system privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands with elevated system privileges, potentially allowing a physical attacker to manipulate device functionality or access sensitive information.

Remediation

Users can apply the February 2026 Security Maintenance Release to address this vulnerability. This update is available through the Samsung Smart Switch application or the Samsung Members app.