CVE-2025-21042: Samsung Mobile Devices out-of-bounds write in libimagecodec.quram.so

CVE-2025-21042 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-11-10

Samsung mobile devices contain a critical security flaw in a component responsible for processing images. An attacker could exploit this by sending a specially crafted image to a device, potentially allowing them to take full control of the phone or steal sensitive data. This vulnerability has been reported as being actively used in targeted attacks.

Technologies: Samsung Mobile Devices. Vendors: Samsung.

Quick answers

Is CVE-2025-21042 exploited in the wild?
Yes. CVE-2025-21042 is known to be exploited in the wild, first recorded on 10 November 2025. Treat it as urgent.
How severe is CVE-2025-21042?
Critical severity, with a CVSS score of 9.8, published 10 November 2025.
Which products and versions are affected?
Samsung Android Prior to SMR Apr-2025 Release 1.
Is there a fix for CVE-2025-21042?
A patch was published on 2025-04-01: Addressed in Samsung SMR Apr-2025 Release 1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-21042 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-21042?
Check whether you run Samsung Mobile Devices. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the 'libimagecodec.quram.so' library on Samsung Android devices. The flaw is triggered during the processing of malformed image files, allowing an attacker to overwrite memory and achieve arbitrary code execution. While NIST rates this as a network-based attack with no user interaction (CVSS 9.8), Samsung's advisory suggests user interaction may be required (CVSS 8.8). This vulnerability is notably included in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been linked to commercial-grade spyware campaigns. A fix is available in the Samsung SMR April 2025 security update.

Affected products

  • Samsung Android Prior to SMR Apr-2025 Release 1

Timeline

  • 2025-04-01: patched: Addressed in Samsung SMR Apr-2025 Release 1
  • 2025-09-12: disclosed: Initial NVD publication
  • 2025-11-10: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-11-10: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.