Loading vulnerability…
Heap-Based Buffer Overflow in Samsung libimagecodec.quram.so JPEG Decoder
CVE-2026-21096 is a heap-based buffer overflow in the JPEG decoder of Samsung's libimagecodec.quram.so, affecting versions before Samsung Mobile Security Release September 2026 Release 1. Improper handling of JPEG image data can overflow heap memory during decoding, enabling remote arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to execute arbitrary code in the context of the vulnerable image-decoding component. The reported CVSS v4 metrics indicate high confidentiality, integrity, and availability impact to the vulnerable system.
If you can’t patch tonight, do this now.
Apply Samsung's September 2026 Security Maintenance Release 1 or a later release. No workaround is specified.
Patch, then assume compromise.
Update affected Samsung Galaxy devices to SMR September 2026 Release 1 or a later Samsung security release containing the fix.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.