MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface
Summary: Project Zero researcher Mateusz Jurczyk reported a large volume of crashes in January 2020 in Qmage, a proprietary Samsung image codec written in C/C++ and built into the Skia graphics library, present on all Samsung phones since Android 4.4.4 and enabled for every app that displays images. Samsung patched the issues, including buffer overflows and other memory corruption, in May 2020 under CVE-2020-8899 and SVE-2020-16747, and Jurczyk then built a zero-click MMS exploit for a Galaxy Note 10+ on Android 10 that bypassed ASLR and obtained a reverse shell with the SMS/MMS app's privileges in around 100 minutes on average.
What's compelling: A codec nobody had heard of, shipped on every Samsung phone since late 2014 and reachable simply by sending a picture, was turned into a zero-click remote shell - and no public Android exploitation of this kind had been documented since Stagefright in 2015.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-8899
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026