CVE-2025-21043
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Description
CVE-2025-21043 is a high-severity out-of-bounds write vulnerability in Samsung's libimagecodec.quram.so library, which handles image processing on Samsung mobile devices running Android 13 through 16. The vulnerability allows remote attackers to execute arbitrary code on affected devices by delivering specially crafted image files. With a CVSS v3.1 base score of 8.8, this Samsung mobile vulnerability affects hundreds of millions of devices worldwide. CISA has added CVE-2025-21043 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 23, 2025, and its EPSS score of 4.91% at the 89th percentile indicates a significant probability of exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 13.0; 14.0; 15.0; 16.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21043(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2025-21043 is classified under CWE-787 (Out-of-bounds Write), one of the most dangerous vulnerability classes. In Samsung's libimagecodec.quram.so image codec library, an out-of-bounds write occurs when the library processes certain crafted image data, writing beyond the allocated buffer boundaries. This memory corruption can be leveraged by an attacker to overwrite control flow data and achieve arbitrary code execution on the mobile device.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2025-21043 presents a serious threat to Samsung mobile device users globally. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L) and no authentication required (PR:N), though user interaction is required (UI:R), typically in the form of viewing a malicious image. Confidentiality (High): An attacker achieving code execution through the image codec can access all data on the device including messages, photos, contacts, authentication tokens, and application data. Integrity (High): Successful exploitation enables installation of persistent malware, modification of device configurations, and tampering with application data. Availability (High): The attacker can disrupt device functionality, brick the device, or use it as part of a botnet. With a CVSS score of 8.8 (High) and the vulnerability affecting Samsung Android devices running versions 13.0, 14.0, 15.0, and 16.0, the EPSS score of 4.91% at the 89th percentile indicates this vulnerability is actively being targeted in the wild, particularly given CISA's confirmation of active exploitation.
Exploit Maturity
CVE-2025-21043 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 4.91% at the 89th percentile indicates significant exploitation activity, placing it in the top 11% of all vulnerabilities by exploitation probability. While no public proof-of-concept exploit code has been identified in the available references, the Samsung security bulletin at Samsung Mobile Security confirms the vulnerability and provides the September 2025 patch. Mobile device vulnerabilities targeting image processing libraries are particularly valuable to threat actors because they can be triggered by simply sending a crafted image through messaging applications, email, or web pages, potentially enabling zero-click exploitation scenarios.
Remediation
-
Install the Samsung SMR September 2025 Release 1 security update on all affected Samsung devices immediately. This update patches the out-of-bounds write vulnerability in libimagecodec.quram.so. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product.
-
Update all affected Android versions. Samsung devices running Android 13.0, 14.0, 15.0, and 16.0 are vulnerable. Ensure the latest security patch level is applied through Settings > Software Update on each device. For enterprise-managed devices, push the update through your MDM solution.
-
Implement interim protections for devices that cannot be immediately updated. Configure mobile device management (MDM) policies to restrict automatic image previewing in messaging applications. Consider using mobile threat defense (MTD) solutions that can detect exploitation attempts targeting image processing libraries.
-
Monitor for indicators of compromise on devices that may have been exposed before patching. Look for unusual battery drain, unexpected data usage, unfamiliar applications, and anomalous device behavior that could indicate compromise. For enterprise environments, review MDM logs for unusual device activity patterns.
-
Enforce automatic security updates as a long-term policy. Configure Samsung devices and enterprise MDM systems to automatically download and install security updates. Regularly audit the fleet to ensure all devices are running the latest security patch level, as image processing vulnerabilities are a recurring attack vector on mobile platforms.
Technical Details
CVE-2025-21043 is an out-of-bounds write vulnerability in Samsung's libimagecodec.quram.so library, which is responsible for image decoding and processing on Samsung Android devices. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the vulnerability is network-exploitable with low complexity and no authentication, requiring only user interaction (such as viewing a crafted image), with high impact on confidentiality, integrity, and availability. The out-of-bounds write (CWE-787) occurs during image decoding when the library fails to properly validate data boundaries during processing of crafted image content. By providing image data that triggers incorrect size calculations or buffer management within the codec, an attacker can cause the library to write beyond the allocated buffer, corrupting adjacent memory. This memory corruption can be leveraged to overwrite return addresses, function pointers, or other control flow data, ultimately achieving arbitrary code execution with the privileges of the media processing service. Affected Samsung Android versions include 13.0, 14.0, 15.0, and 16.0, and the fix was released as part of the Samsung SMR September 2025 Release 1.
Frequently Asked Questions
Is CVE-2025-21043 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-21043 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 23, 2025. The EPSS score of 4.91% at the 89th percentile indicates significant exploitation activity against Samsung mobile devices.
What products are affected by CVE-2025-21043?
Samsung mobile devices running Android versions 13.0, 14.0, 15.0, and 16.0 are affected. The vulnerability is in the libimagecodec.quram.so image processing library, which is a Samsung-specific component used across their mobile device lineup.
How do I fix CVE-2025-21043?
Install the Samsung SMR September 2025 Release 1 security update on all affected Samsung devices. The update can be applied through Settings > Software Update on each device, or pushed through enterprise MDM solutions. All Samsung devices running Android 13 through 16 should be updated.
How severe is CVE-2025-21043?
CVE-2025-21043 is rated High with a CVSS v3.1 base score of 8.8. The vulnerability allows remote attackers to execute arbitrary code on Samsung mobile devices by exploiting an out-of-bounds write in the image processing library. The main requirement for exploitation is that a user must interact with a crafted image, which can be delivered through messaging apps, email, or web pages.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.