Loading vulnerability…
Remote code execution in Samsung Quram DNG decoder
CVE-2026-21095 is a heap-based buffer overflow in the DNG decoder of Samsung's Quram image codec library, affecting Galaxy devices running Android 14 through Android 17 before SMR Sep-2026 Release 1. Processing a crafted DNG image can allow a remote attacker to execute arbitrary code. The vulnerability is also tracked as SVE-2026-3247.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause arbitrary code execution and high confidentiality, integrity, and availability impact on affected devices. The execution privilege level and any ability to escape the decoder's execution context are not specified.
If you can’t patch tonight, do this now.
Until the update is installed, restrict processing of untrusted DNG images and apply device and content-handling controls to prevent attacker-supplied DNG images from reaching the vulnerable decoder.
Patch, then assume compromise.
Install Samsung Security Maintenance Release September 2026 Release 1 or a later device update containing the fix. Update availability varies by Galaxy model and region.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.