CVE-2025-21042: high-severity vulnerability in Samsung Mobile Devices
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in libimagecodec.quram.so allows attackers to write data beyond memory boundaries, potentially giving them the ability to run malicious code on affected devices. This affects phones with Samsung's April 2025 security update or earlier.
Out-of-bounds write vulnerability in libimagecodec.quram.so enables remote code execution via crafted image files. The attack vector is remote (malicious image input), with no authentication required. Impact includes arbitrary code execution with process privileges prior to patching in SMR Apr-2025 Release 1.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.