Samsung Patches Critical Galaxy Image Decoder RCE Flaws
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Sep 9, 2026
Samsung’s September 2026 security update fixes two critical remote-code-execution vulnerabilities in Galaxy devices: CVE-2026-21095 and CVE-2026-21096. The flaws are heap-based buffer overflows in the DNG and JPG decoders within libimagecodec.quram.so; successful exploitation could allow an attacker to execute arbitrary code remotely through a crafted image.
The bulletin also incorporates applicable Android security fixes, including 18 critical and 40 high-severity issues reported by Google, plus 31 Samsung-specific fixes. Samsung says 40 of the Google-listed vulnerabilities do not affect Galaxy products. Updates cover supported devices running Android 14 through Android 17, though availability varies by device model, carrier, and region.
