{"id":"CVE-2025-21042","kind":"vulnerability","aliases":["CVE-2025-21042"],"related":[],"title":"samsung android: Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute…","description":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Samsung mobile devices contain an out-of-bounds write flaw in the libimagecodec.quram.so image codec library. A remote attacker could exploit it to execute arbitrary code on the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-11-10T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 14.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 15.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile","samsung"],"not_affected_if":["unpatched-devices-only-if-updated"],"how_to_check":"Check the Samsung device's security patch level in Settings > About phone > Software information; compare it with Samsung's bulletin for the month the fix shipped. unknown for a command.","fix":"Install the latest Samsung security update for the affected device; the sources do not name the fixed patch level. unknown for the exact version.","status":"open","published_at":"2025-09-12T08:15:44+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:23+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:44:23Z","model":"claude-haiku-5-5","output":{"fix":"Install the latest Samsung security update for the affected device; the sources do not name the fixed patch level. unknown for the exact version.","reach":"internet","summary":"Samsung mobile devices contain an out-of-bounds write flaw in the libimagecodec.quram.so image codec library. A remote attacker could exploit it to execute arbitrary code on the device.","category":"infrastructure","who_cares":["samsung","android","mobile"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the phone after a crafted image is processed.","analyst_note":"Find the Samsung security bulletin naming CVE-2025-21042 and the fixed patch levels, and whether user interaction (e.g. opening a crafted image via messaging) is required; see CISA KEV entry and Samsung bulletins.","how_to_check":"Check the Samsung device's security patch level in Settings > About phone > Software information; compare it with Samsung's bulletin for the month the fix shipped. unknown for a command.","needs_analyst":true,"not_affected_if":["unpatched-devices-only-if-updated"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2551,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':107C '-2025':14A,23A,26A '-21042':24A,27A '1':16A '22':106C 'action':97C 'allow':17A,88C 'android':2A,32A,34A,36A,37B 'appli':98C 'applic':104C 'apr':13A 'arbitrari':67B,93C 'attack':19A,61B,90C 'bod':105C 'bound':6A,50B,80C 'cisa':95C 'cloud':110C 'code':68B,94C 'codec':57B 'contain':45B,75C 'could':62B,87C 'cve':22A,25A 'devic':44B,71B,74C 'devices':30A 'discontinu':113C 'execut':21A,66B,92C 'exploit':38B,63B 'flaw':52B 'follow':103C 'guidanc':108C 'imag':56B 'infrastructur':39B 'instruct':102C 'libimagecodec.quram.so':9A,55B,84C 'librari':58B 'mitig':99C,119C 'mobil':40B,43B,73C 'mobile':29A 'out-of-bound':3A,47B,77C 'per':100C 'prior':10A 'product':117C 'releas':15A 'remot':18A,60B,89C 'requir':96C 'samsung':1A,28A,31A,33A,35A,41B,42B,72C 'servic':111C 'smr':12A 'unavail':121C 'use':114C 'vendor':101C 'vulner':82C,86C 'write':7A,51B,81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-12T08:15:44+00:00","kev":{"dateAdded":"2025-11-10","dueDate":"2025-12-01","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-21042","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21042","severity":null,"published_at":"2025-11-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-21042","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21042","severity":null,"published_at":"2025-09-12T08:15:44+00:00","modified_at":"2026-10-08T10:35:13+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}