Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware
Summary: A now-patched out-of-bounds write flaw in Samsung Galaxy Android devices, CVE-2025-21042 (CVSS 8.8) in the libimagecodec.quram.so component, was exploited as a zero-day to deliver commercial-grade Android spyware called LANDFALL in targeted attacks in the Middle East, and Samsung addressed it in April 2025. Palo Alto Networks Unit 42 assessed the attacks sent malicious DNG image files via WhatsApp, with LANDFALL samples dating to July 23, 2024, and the spyware targets Galaxy S22, S23, and S24 series plus Z Fold 4 and Z Flip 4, harvesting microphone recordings, location, photos, contacts, SMS, files, and call logs.
Why it matters: CISA added CVE-2025-21042 to its KEV catalog on November 10, 2025, requiring federal civilian agencies to remediate by December 1, 2025 - a deadline that puts every unpatched Galaxy S22 through S24 and Z Fold 4 or Z Flip 4 in your fleet on the same clock.