{"id":"CVE-2025-21043","kind":"vulnerability","aliases":["CVE-2025-21043"],"related":[],"title":"samsung android: Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute…","description":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Samsung mobile devices contain an out-of-bounds write bug in the libimagecodec.quram.so image codec library. A remote attacker can run arbitrary code on the device, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-10-02T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 14.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 15.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 16.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","mobile-devices","samsung","vendor"],"not_affected_if":["unpatched-devices-excluded"],"how_to_check":"Open Settings > About phone > Software information and compare the security patch level with Samsung's bulletin for CVE-2025-21043.","fix":"Update the device to the latest Samsung security patch; CISA says to apply vendor mitigations or stop using affected devices if none exist.","status":"open","published_at":"2025-09-12T08:15:44+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:44+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:44:44Z","model":"claude-haiku-5-5","output":{"fix":"Update the device to the latest Samsung security patch; CISA says to apply vendor mitigations or stop using affected devices if none exist.\nunknown","reach":"internet","summary":"Samsung mobile devices contain an out-of-bounds write bug in the libimagecodec.quram.so image codec library. A remote attacker can run arbitrary code on the device, and CISA lists it as actively exploited.","category":"vendor","who_cares":["samsung","android","mobile-devices"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the device via a crafted image.","analyst_note":"Find Samsung's security bulletin for CVE-2025-21043 to get affected models, patched versions and the exact patch level; the KEV entry alone does not give them.","how_to_check":"Open Settings > About phone > Software information and compare the security patch level with Samsung's bulletin for CVE-2025-21043.\nunknown","needs_analyst":true,"not_affected_if":["unpatched-devices-excluded"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000455,"input_tokens":2544,"output_tokens":402,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':113C '-2025':14A,23A,26A '-21043':24A,27A '1':16A '22':112C 'action':103C 'activ':78B 'allow':17A,94C 'android':2A,32A,34A,36A,38A,39B 'appli':104C 'applic':110C 'arbitrari':68B,99C 'attack':19A,65B,96C 'bod':111C 'bound':6A,54B,88C 'bug':56B 'cisa':74B,101C 'cloud':116C 'code':69B,100C 'codec':61B 'contain':49B,83C 'cve':22A,25A 'devic':43B,48B,72B,82C 'devices':30A 'discontinu':119C 'execut':21A,98C 'exploit':40B,79B 'follow':109C 'guidanc':114C 'imag':60B 'instruct':108C 'libimagecodec.quram.so':9A,59B,92C 'librari':62B 'list':75B 'mitig':105C,125C 'mobil':42B,47B,81C 'mobile':29A 'mobile-devic':41B 'out-of-bound':3A,51B,85C 'per':106C 'prior':10A 'product':123C 'releas':15A 'remot':18A,64B,95C 'requir':102C 'run':67B 'samsung':1A,28A,31A,33A,35A,37A,44B,46B,80C 'sep':13A 'servic':117C 'smr':12A 'unavail':127C 'use':120C 'vendor':45B,107C 'vulner':90C 'write':7A,55B,89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-12T08:15:44+00:00","kev":{"dateAdded":"2025-10-02","dueDate":"2025-10-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-21043","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21043","severity":null,"published_at":"2025-10-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-21043","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21043","severity":null,"published_at":"2025-09-12T08:15:44+00:00","modified_at":"2026-10-08T12:54:41+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}