Actively exploited in the wild
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung - Mobile Devices · Listed in the CISA KEV since 2025-11-10. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-21042
HighCVSS 8.8KEVSummary
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
Risk Assessment
A remote attacker can execute arbitrary code in the context of image processing, potentially leading to device compromise. The risk is high for Samsung devices with the unpatched library version.
Recommendation
Install the SMR Apr-2025 Release 1 or later update for affected devices. Also avoid opening images from untrusted sources until the update is applied.
Other vulnerabilities in libimagecodec.quram.so
See all- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2025-21043HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
Original NVD description (English source)
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.