MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec

Summary: Project Zero's Mateusz Jurczyk built a fuzzing harness called SkCodecFuzzer to target Samsung's Qmage image codec, which is reachable via MMS through the default Samsung Messages app and is natively supported on all modern Samsung phones. He ran the ARM/ARM64 codec under qemu-aarch64 on x86-64 at roughly a 3x slowdown versus a Samsung device, and added a custom signal handler that emits ASAN-style crash reports with ARM disassembly and symbol names from libhwui.so.
Why it matters: The attack surface here is zero-click: an image codec reached through MMS on the default messaging app, with no user action required to trigger the vulnerable parsing path. The crash report shows the fault landing inside PVcodecDecoder_GrayScale_16bits_NEW in libhwui.so, which is the kind of memory corruption primitive that precedes remote code execution.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026