CVE-2025-21042
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Description
CVE-2025-21042 is a high-severity out-of-bounds write vulnerability in Samsung's libimagecodec.quram.so library affecting Android versions 13, 14, and 15 on Samsung mobile devices. Rated at CVSS v3.1 score of 8.8, the flaw allows remote attackers to execute arbitrary code by sending a specially crafted image to the device. This vulnerability was patched in the Samsung SMR April 2025 Release 1 and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of December 1, 2025. The EPSS score of 0.01718 (82.1st percentile) indicates significant exploitation probability, and Unit 42 has linked this vulnerability to commercial-grade Android spyware operations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 13.0; 14.0; 15.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04(Vendor Advisory)
- https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/(Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21042(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 occurs when a program writes data past the boundaries of allocated memory buffers, potentially corrupting adjacent data structures and enabling arbitrary code execution. In CVE-2025-21042, the Samsung proprietary image codec library libimagecodec.quram.so fails to properly validate bounds when processing image data, allowing a maliciously crafted image file to trigger a write beyond the allocated buffer and execute attacker-controlled code on the device.
Impact Analysis
The business impact of CVE-2025-21042 is severe due to its potential for zero-click or low-interaction remote code execution on Samsung mobile devices. Confidentiality, integrity, and availability are all rated as high impact. A successful exploit allows the attacker to execute arbitrary code with the privileges of the media processing service, which on Samsung devices typically has broad access to device storage, camera, microphone, and communication channels. This enables comprehensive surveillance including reading messages, capturing photos and audio, accessing contacts, and tracking device location.
The threat context is particularly concerning because Palo Alto Networks' Unit 42 has directly linked this vulnerability to commercial-grade Android spyware operations in their published analysis. This means the vulnerability is not being exploited by opportunistic attackers but by sophisticated threat actors deploying targeted surveillance tools. The User Interaction (Required) metric means the victim must open or process a malicious image, but in practice this can be achieved through MMS messages, email attachments, or messaging applications that automatically render image previews. The EPSS score of 0.01718 (82.1st percentile) confirms elevated exploitation activity. With Samsung holding a dominant share of the global Android market across enterprise and government users, the impact footprint is extensive. Ransomware association is listed as unknown, though the primary threat vector here is espionage-oriented spyware rather than ransomware.
Exploit Maturity
CVE-2025-21042 is confirmed as actively exploited in the wild through commercial spyware operations. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of December 1, 2025. EPSS context: The score of 0.01718 (82.1st percentile) indicates above-average exploitation probability, consistent with targeted rather than mass exploitation.
Spyware connection: Palo Alto Networks' Unit 42 published a detailed analysis titled "Landfall is New Commercial-Grade Android Spyware" that directly links CVE-2025-21042 to commercial spyware deployment against targeted individuals. This indicates state-sponsored or commercially motivated surveillance operations rather than conventional cybercrime. Ransomware association: Currently listed as unknown. The exploitation pattern is consistent with espionage and surveillance use cases rather than ransomware deployment.
Remediation
-
Apply Samsung's April 2025 security update — Install the SMR April 2025 Release 1 or later on all Samsung devices running Android 13, 14, or 15. The update is available through the device's Settings > Software update menu or through enterprise MDM solutions. Refer to the Samsung Mobile Security bulletin for details.
-
Enforce MDM update compliance — For enterprise environments, configure your Mobile Device Management solution to require the April 2025 security patch level or later and block access to corporate resources from devices that have not been updated.
-
Disable automatic MMS download — As an interim mitigation, configure Samsung devices to not automatically download MMS attachments. This reduces the risk of the malicious image being processed without explicit user action. Instruct users to avoid opening image attachments from unknown senders.
-
Deploy mobile threat defense — Implement a mobile threat defense solution that can detect exploitation attempts targeting media processing libraries and identify indicators associated with the Landfall spyware family documented by Unit 42.
-
Review high-risk user devices — For users who may be targets of surveillance (executives, security personnel, journalists, or individuals in sensitive roles), perform a forensic review of their Samsung devices for indicators of compromise associated with commercial spyware. Look for unusual battery drain, unexpected data usage, or unknown device administrator profiles.
Technical Details
The CVSS v3.1 vector for CVE-2025-21042 is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a high score of 8.8. Attack Vector (Network) means the exploit can be delivered remotely through any channel that transmits image data — including MMS, email, messaging apps, or web content. Attack Complexity (Low) indicates the crafted image reliably triggers the vulnerability. Privileges Required (None) confirms no authentication is needed. User Interaction (Required) means the victim must open or process the malicious image, though this interaction can be as minimal as viewing a message preview.
The vulnerability exists in Samsung's proprietary image codec library libimagecodec.quram.so, which is responsible for decoding various image formats on Samsung Android devices. When this library processes a specially crafted image file, it fails to properly validate the dimensions or payload size against the allocated buffer, causing a write operation to exceed buffer boundaries. The out-of-bounds write corrupts adjacent heap memory, which an attacker can leverage to overwrite function pointers or virtual method tables, ultimately achieving arbitrary code execution in the context of the media processing service. Samsung's image processing pipeline is invoked automatically for various operations including thumbnail generation, image preview rendering, and media scanning, which increases the potential attack surface. The Scope (Unchanged) rating indicates exploitation is contained within the Samsung media processing context, though in practice the achieved code execution can be chained with additional exploits for full device compromise, as demonstrated by the Landfall spyware campaign.
Frequently Asked Questions
What is CVE-2025-21042?
CVE-2025-21042 is a remote code execution vulnerability in Samsung's image processing library (libimagecodec.quram.so) that affects Samsung devices running Android 13, 14, and 15. An attacker can send a specially crafted image to a Samsung device, and when the image is processed, it triggers an out-of-bounds write that allows arbitrary code execution.
Has this vulnerability been used in real attacks?
Yes, Palo Alto Networks' Unit 42 has documented this vulnerability being used in commercial-grade Android spyware operations known as "Landfall." This indicates the vulnerability has been weaponized by sophisticated threat actors conducting targeted surveillance against specific individuals.
How can the vulnerability be triggered?
The vulnerability can be triggered when a Samsung device processes a malicious image file. This can happen through receiving an MMS message, opening an email attachment, viewing an image in a messaging app, or browsing a webpage that serves the crafted image. Some applications may automatically process images for thumbnail or preview generation.
What Samsung devices are affected?
All Samsung mobile devices running Android 13, 14, or 15 with security patch levels prior to the SMR April 2025 Release 1 are affected. Users should check their current security patch level in Settings > About phone > Software information and update to the latest available version.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.