# CVE-2025-21043: Samsung Mobile Devices out-of-bounds write in libimagecodec.quram.so

Source: https://junglewise.ai/threats/cve-2025-21043-samsung-mobile-devices-out-of-bounds-write-in-libimagecodec-quram  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-02. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-21043 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-10-02

Samsung mobile devices contain a critical security flaw in a component responsible for processing images. An attacker could exploit this vulnerability to remotely take control of a device or execute unauthorized commands. This issue is particularly serious as it has been reported to be actively exploited in the wild.

Technologies: [Samsung Mobile Devices](https://junglewise.ai/threats/technologies/mobile-devices). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2025-21043 exploited in the wild?** Yes. CVE-2025-21043 is known to be exploited in the wild, first recorded on 2 October 2025. Treat it as urgent.

**How severe is CVE-2025-21043?** Critical severity, with a CVSS score of 9.8, published 2 October 2025.

**Which products and versions are affected?** Samsung Android Prior to SMR Sep-2025 Release 1.

**Is there a fix for CVE-2025-21043?** A patch was published on 2025-09-12: Addressed in SMR Sep-2025 Release 1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-21043 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-21043?** Check whether you run Samsung Mobile Devices. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the libimagecodec.quram.so library on Samsung mobile devices. The flaw is triggered during the processing of malformed image files, allowing a remote attacker to overwrite memory and achieve arbitrary code execution. While some assessments suggest user interaction (UI:R) may be required to trigger the image processing, NIST has rated this as a network-based attack with no privileges required. The vulnerability was addressed in the Samsung SMR September 2025 security update. CISA has confirmed active exploitation of this flaw.

## Affected products

- Samsung Android Prior to SMR Sep-2025 Release 1

## Timeline

- 2025-09-12: disclosed: Initial disclosure by Samsung Mobile
- 2025-09-12: patched: Addressed in SMR Sep-2025 Release 1
- 2025-10-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [Samsung Mobile Devices out-of-bounds write in libimagecodec.quram.so](https://junglewise.ai/threats/cve-2025-21042-samsung-mobile-devices-out-of-bounds-write-in-libimagecodec-quram)
- [Samsung Mobile Devices Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-22265-samsung-mobile-devices-use-after-free-vulnerability)
- [Samsung Mobile Devices Unspecified Vulnerability](https://junglewise.ai/threats/cve-2021-25371-samsung-mobile-devices-unspecified-vulnerability)
- [Samsung Mobile Devices Improper Boundary Check Vulnerability](https://junglewise.ai/threats/cve-2021-25372-samsung-mobile-devices-improper-boundary-check-vulnerability)
- [Samsung Mobile Devices Improper Input Validation Vulnerability](https://junglewise.ai/threats/cve-2021-25489-samsung-mobile-devices-improper-input-validation-vulnerability)