important · Zero-click
A remote Samsung ImsService traversal can create image files with system-server privilege.
Affects
Samsung Galaxy mobile devices running Samsung's IMS telephony service.
Samsung does not establish the cheapest remote position, controlled bytes, overwrite behavior, or a useful writable destination.
Detail and 1 source
Chain to watch
Reach an undisclosed remote ImsService input→↓Escape the intended image destination with traversal→↓Create an image file at system-server privilege→↓The access position, controllable content, destination set, and composition into execution or persistence remain unresolved.
Unverified chainTrace IMS, MMS, and RCS inputs on a pre-patch device to identify the endpoint, authentication requirements, and writable destinations.