CVE-2025-21043KEV Β· OVERDUECWE-787

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

High Β· published September 12, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 82.5th percentile for exploit probability.

366
days past CISA
deadline
CVSS v3.1
8.8
EPSS
2%
Percentile
82.5
In the wild
Confirmed
What it is

🚨 An out-of-bounds write in libimagecodec.quram.so is like a delivery driver misreading an address and leaving packages in the wrong places! This vulnerability allows remote attackers to execute arbitrary code on your system! πŸ”₯ Think of it as a waiter misplacing an entire table’s orders because they didn’t double-check the ticket. One wrong move can lead to chaos, potentially allowing hackers to run any malicious code they want. The implications are serious: attackers could gain complete control over your system, accessing sensitive data, altering files, or even taking down your services entirely. Imagine someone walking right into your digital fortress and wreaking havoc!

Put simply

Think of it as a waiter misplacing an entire table’s orders because they didn’t double-check the ticket. One wrong move can lead to chaos, potentially allowing hackers to run any malicious code they want. This high-risk out-of-bounds write vulnerability enables remote attackers to send crafted data that can lead to code execution, exploiting the libimagecodec.quram.so library, which processes image files.

What to do

The implications are serious: attackers could gain complete control over your system, accessing sensitive data, altering files, or even taking down your services entirely. Imagine someone walking right into your digital fortress and wreaking havoc! To safeguard your systems, update to the SMR Sep-2025 Release 1 immediately. Additionally, implement proper input validations and keep your libraries updated to minimize exposure to such exploits. You've got this! By following these steps, you can lock down your systems and keep those pesky attackers at bay! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
8.8 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02216 Β· 82.5th percentile
Weakness
CWE-787 Β· Out-of-bounds Write
Published
2025-09-12T12:15Z
KEV added
2025-10-02 Β· due 2025-10-23
Affected products (105)
ProductVersionsFixed in
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
samsung/androidall versionsβ€”
References (2)
EPSS history
Timeline
  • 02 OCT 00:00Z
    Added to CISA KEV β€” remediate by Oct 23
    kev
  • 12 SEP 07:21Z
    Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code
    cvelistv5