CVE-2025-21042KEV Β· OVERDUECWE-787

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

High Β· published September 12, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.4th percentile for exploit probability.

327
days past CISA
deadline
CVSS v3.1
8.8
EPSS
35%
Percentile
98.4
In the wild
Confirmed
What it is

⚑ An out-of-bounds write in libimagecodec.quram.so could let remote attackers execute arbitrary code without breaking a sweat! πŸ”₯ Think of it like a delivery service that accidentally sends packages to the wrong address because of a mislabel β€” once the wrong package is in the hands of the wrong person, there’s no telling what could happen! An attacker could take full control of the affected system, executing malicious code that could lead to data theft, system compromise, or even a full-blown takeover! This is a serious threat that can wreak havoc if not addressed immediately.

Put simply

Think of it like a delivery service that accidentally sends packages to the wrong address because of a mislabel β€” once the wrong package is in the hands of the wrong person, there’s no telling what could happen! This vulnerability allows attackers to exploit an out-of-bounds write within libimagecodec.quram.so, resulting in the potential execution of arbitrary code when processing certain inputs.

What to do

An attacker could take full control of the affected system, executing malicious code that could lead to data theft, system compromise, or even a full-blown takeover! This is a serious threat that can wreak havoc if not addressed immediately. To protect yourself, update libimagecodec to the SMR Apr-2025 Release 1 or later. It’s also a good idea to review your systems for any unintended exposure to untrusted inputs that might exploit this flaw. You've got this! Just follow these steps and you'll lock this vulnerability down like a security pro. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
8.8 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.34549 Β· 98.4th percentile
Weakness
CWE-787 Β· Out-of-bounds Write
Published
2025-09-12T12:15Z
KEV added
2025-11-10 Β· due 2025-12-01
Affected products (88)
ProductVersionsFixed in
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
References (3)
EPSS history
Timeline
  • 10 NOV 00:00Z
    Added to CISA KEV β€” remediate by Dec 1
    kev
  • 12 SEP 07:21Z
    Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code
    cvelistv5