CVE-2025-21043 is a critical vulnerability affecting Samsung Galaxy devices running the Android operating system. The vulnerability resides in Samsung’s Quram image processing library (libimagecodec.quram.so), which is used by applications that handle images on Samsung devices. This includes popular messaging apps like WhatsApp, making the vulnerability particularly concerning due to the potential for widespread exploitation.
| Date | 2025-09-22 16:24:34 |
| Information |
|
Technical Summary
This is an Out-of-Bounds Write vulnerability with a CVSS score of 8.8 out of 10.0, classifying it as high severity. The vulnerability allows remote attackers to execute arbitrary code by exploiting the processing of malicious images. An out-of-bounds write occurs when a program writes data beyond the boundaries of an allocated memory buffer, which can corrupt data, crash the program, or allow attackers to execute code.
Critical aspects of this vulnerability:
- Zero-day exploitation: The vulnerability was actively exploited before Samsung released the patches.
- Remote Code Execution: Attackers can execute code by sending malicious images via messaging apps.
- Widespread impact: It affects Samsung Galaxy devices running Android versions 13 through 16.
- Spyware connection: The vulnerability was allegedly exploited by a spyware vendor, according to security teams at Meta and WhatsApp (August 13).
Recommendations
Immediate update: Install the September 2025 Samsung security package (SMR Sep-2025 Release 1) immediately. Check via Settings > Software update > Download and install.
Caution with images: Until the patch is applied, use extreme caution with images from untrusted sources, particularly via messaging apps like WhatsApp.
Priority deployment: Organizations managing Samsung Galaxy devices must prioritize this update, given the remote execution capability and active exploitation.
Device inventory: Identify all Samsung Galaxy devices running Android 13 to 16 in the organization and ensure they receive the September 2025 security update.
Monitoring: Implement monitoring systems to detect suspicious activity related to image processing or abnormal application crashes.
User training: Inform users about the risks associated with opening images from unknown sources until devices are updated.
Protect your organisation with Threat Intelligence and Digital Risk Protection.
Choose ISGroup for a practical, tailored engagement:
- A focused assessment of your environment and requirements
- Clear findings with a prioritised, actionable roadmap
- Direct support from experienced specialists through remediation and implementation