CVE-2020-8899CWE-122

Memory corruption in Quram library when decoding qmg can lead to RCE

Critical · published May 6, 2020

CVSS v4.0
10.0
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

🚨 A crafty MMS could unleash chaos on your phone! A vulnerable buffer in Samsung's Quram library creates a direct line for unauthorized attackers without any user interaction! 🔥 Think of it like someone slipping a dangerous package into the wrong mailbox—once it's inside, they can access everything that’s stored in your home without you ever knowing. That's how the buffer overflow in the Quram image codec works, granting hackers unrestricted access! With this vulnerability, an attacker could execute arbitrary code, potentially taking control of your device, stealing personal data, or even installing malicious software—all with just a specially crafted MMS. This is absolutely devastating for users, as it requires no action on their part!

Put simply

Think of it like someone slipping a dangerous package into the wrong mailbox—once it's inside, they can access everything that’s stored in your home without you ever knowing. That's how the buffer overflow in the Quram image codec works, granting hackers unrestricted access! The CVE-2020-8899 vulnerability allows an unauthorized attacker to exploit a heap-based buffer overflow in the Quram image codec for Samsung’s Android OS versions 8.x, 9.0, and 10.0 by sending a crafted MMS, leading to remote code execution without user interaction.

What to do

With this vulnerability, an attacker could execute arbitrary code, potentially taking control of your device, stealing personal data, or even installing malicious software—all with just a specially crafted MMS. This is absolutely devastating for users, as it requires no action on their part! To protect yourself, update your Samsung devices to the latest available firmware that patches this vulnerability. Regularly check for updates and consider disabling MMS if possible to limit exposure until you can apply the patch. 🛡️ You've got this! Stay vigilant, keep your devices updated, and you'll be a security hero in no time! 💪✨

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.06124 · 93.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2020-05-06T16:25Z
EPSS history
Timeline
  • 06 MAY 16:25Z
    Memory corruption in Quram library when decoding qmg can lead to RCE
    cvelistv5