Samsung Galaxy flaws exposed remote image RCE and SystemUI privilege escalation
Vulnerability Disclosure · 5 sources · Updated 4mo ago · First seen Jun 12, 2026
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including remote code execution flaws in the proprietary Quram image codec and a separate improper access control bug in the Routines automation feature. CVE-2025-21042 and CVE-2025-21043 are out-of-bounds write issues in libimagecodec.quram.so that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said CVE-2025-21042 was fixed in the April 2025 Security Maintenance Release, while CVE-2025-21043 was addressed in the September 2025 SMR.
The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a zero-click MMS chain that achieved code execution on a Galaxy Note 10+. Samsung also patched CVE-2025-21058, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with SystemUI privileges via Galaxy Routines before versions 4.8.7.1 and 4.9.6.0. Separately, Google fixed Android framework flaw CVE-2025-32322 in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
