Loading story…
Samsung’s September 2026 security update fixes two critical remote-code-execution vulnerabilities in Galaxy devices: CVE-2026-21095 and CVE-2026-21096. The flaws are heap-based buffer overflows in the DNG and JPG decoders within libimagecodec.quram.so; successful exploitation could allow an attacker to execute arbitrary code remotely through a crafted image.
The bulletin also incorporates applicable Android security fixes, including 18 critical and 40 high-severity issues reported by Google, plus 31 Samsung-specific fixes. Samsung says 40 of the Google-listed vulnerabilities do not affect Galaxy products. Updates cover supported devices running Android 14 through Android 17, though availability varies by device model, carrier, and region.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Samsung released its September 2026 security bulletin for Galaxy devices, incorporating Android fixes and 31 Samsung-specific fixes. It remediates critical heap-based buffer overflows CVE-2026-21095 and CVE-2026-21096 in libimagecodec.quram.so's DNG and JPG decoders, which could permit remote arbitrary-code execution on affected Android 14–17 devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including **remote code execution** flaws in the proprietary Quram image codec and a separate **improper access control** bug in the Routines automation feature. **CVE-2025-21042** and **CVE-2025-21043** are out-of-bounds write issues in `libimagecodec.quram.so` that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said **CVE-2025-21042** was fixed in the **April 2025 Security Maintenance Release**, while **CVE-2025-21043** was addressed in the **September 2025 SMR**. The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a **zero-click MMS** chain that achieved code execution on a Galaxy Note 10+. Samsung also patched **CVE-2025-21058**, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with **SystemUI privileges** via Galaxy Routines before versions **4.8.7.1** and **4.9.6.0**. Separately, Google fixed Android framework flaw **CVE-2025-32322** in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
Jun 29, 2026Samsung has released a security update to address CVE-2025-21043, a critical remote code execution vulnerability exploited in zero-day attacks against Android 13+ devices. The flaw, found in the closed-source image parsing library libimagecodec.quram.so, allows remote attackers to execute arbitrary code via specially crafted image files. Security experts urge immediate patching and enhanced mobile threat detection due to the active exploitation and potential for rapid spread.
Jun 29, 2026
Samsung released its August 2026 Security Maintenance Release for Galaxy smartphones and tablets, patching **56 vulnerabilities** across supported devices running Android 14, 15, and 16. The update incorporates **38 fixes** from Google’s August Android Security Bulletin and **18 Samsung-specific patches** affecting One UI and Galaxy software, with Google’s share including **eight critical** and **30 high-severity** issues. Samsung said the device-specific fixes address components including **SemClipboardService**, **Samsung Contacts**, **Dialer**, **Messages**, **Galaxy Themes**, **AppLock**, media codecs, and the **Weaver** hardware component. The company also noted that nine vulnerabilities listed by Google were not included in the Galaxy update because one had already been fixed in July and eight did not affect Samsung devices due to unused hardware or configurations; rollout is expected to begin with newer flagship models before expanding to older supported Galaxy and A-series devices, while national CERT advisories have also flagged Samsung product vulnerabilities.
Aug 16, 2026