A look at an Android ITW DNG exploit
Summary: Between July 2024 and February 2025, six suspicious DNG image files were uploaded to VirusTotal and, following a lead from Meta, came to Google Threat Intelligence Group, which found they targeted the Quram image parsing library used on Samsung devices. The exploits were delivered as images received over WhatsApp, and the Samsung vulnerability they abused was fixed in April 2025.
Why it matters: The exploit chain runs through com.samsung.ipservice, a Samsung system service that periodically scans and parses images in Android's MediaStore, so a downloaded WhatsApp image can reach image parsing attack surface without the user opening it - and the attacker controls both the write offset and the value written into the raw pixel buffer.
Read the original at Google Project Zero ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026