Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks
Summary: Samsung's September 2025 security update fixes CVE-2025-21043, a critical out-of-bounds write (CVSS 8.8) in the closed-source libimagecodec.quram.so image parsing library that allows remote attackers to execute arbitrary code on Android 13, 14, 15, and 16. The flaw was privately disclosed on August 13, 2025, and Samsung acknowledged an exploit for it has existed in the wild, without detailing how it is being used or who is behind it.
Why it matters: A remotely reachable code-execution bug in a closed-source image library shipped across four Android versions is already exploited in the wild, and Samsung has disclosed nothing about the attackers or their methods. The fix arrives only in the September 2025 release, so every unpatched device running Android 13 through 16 remains exposed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-21043CVE-2025-38352CVE-2025-48543
- Related
- Microsoft Patch Tuesday, September 2025 Edition Cyber Risks ·