Actively exploited in the wild
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung - Mobile Devices · Listed in the CISA KEV since 2025-10-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-21043
HighCVSS 8.8KEVExploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
Risk Assessment
A remote attacker can execute arbitrary code in the context of image processing, potentially leading to device compromise. The risk is high for Samsung devices with the unpatched library version.
Recommendation
Install the SMR Sep-2025 Release 1 or later update for affected devices. Also avoid opening images from untrusted sources until the update is applied.
Other vulnerabilities in libimagecodec.quram.so
See all- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2025-21042HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
- CVE-2025-58479Medium
An out-of-bounds read exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-58478Medium
An out-of-bounds write exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-58477Medium
An out-of-bounds write exists in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-21075Medium
Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. This could lead to crashes or potential code execution.
- CVE-2025-21074Medium
An out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. The vulnerability affects the image codec library.
- CVE-2025-21055Medium
Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Original NVD description (English source)
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS