erroneo.us
Search all guides⌘K

Security Digest · Sep 12, 2025 · Vulnerability · Mobile

Samsung Image Library Zero-Days CVE-2025-21042/21043

Two exploited bugs in Samsung's libimagecodec.quram.so, one used by LANDFALL spyware. Fixed in SMR Apr-2025 and Sep-2025. Find lagging Galaxy phones.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Both bugs were fixed in 2025 and phones that took updates are safe, but Galaxy devices with a security patch level before September 2025, including models Samsung no longer updates, remain open to image-borne spyware.

Who must act: Anyone managing Samsung Galaxy phones or tablets on Android 13 to 16 with a security patch level before September 2025, especially Galaxy S22, S23, S24, Z Fold4 and Z Flip4 units used by people likely to be targeted.

Who can relax: Samsung devices on SMR Sep-2025 Release 1 or any later security update; phones from other Android vendors are not covered by these Samsung advisories.

Affected
Samsung devices on Android 13, 14 and 15 before SMR Apr-2025 Release 1 (CVE-2025-21042)
Samsung devices on Android 13, 14, 15 and 16 before SMR Sep-2025 Release 1 (CVE-2025-21043)
Fixed in
SMR Apr-2025 Release 1 (CVE-2025-21042)
SMR Sep-2025 Release 1 (CVE-2025-21043, and includes the April fix)
CVSS
9.8 (v3.1, NVD)
EPSS
35.6% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Pull the Android security patch level for every Samsung device from MDM, or run adb shell getprop ro.build.version.security_patch, and flag anything before 2025-09-01.
  2. Install the latest available Samsung security update on flagged devices and set a minimum patch level in your MDM compliance policy.
  3. Replace or block from corporate access Samsung devices that no longer receive monthly or quarterly security updates.
  4. For high-risk users, prioritize the Galaxy S22, S23, S24, Z Fold4 and Z Flip4 models that LANDFALL was built for.

How to check if you are affected or compromised

  • Search DNS, proxy and firewall logs for the LANDFALL C2 servers Unit 42 published: brightvideodesigns[.]com, hotelsitereview[.]com, healthyeatingontherun[.]com, projectmanagerskills[.]com and their IPs.
  • Hash-match received images against Unit 42's published DNG sample hashes; the files carry WhatsApp-style names such as IMG-20240723-WA0000.jpg.
  • On a device examined forensically, look for LANDFALL files (b.so, l.so, aa.so) under /data/data/com.samsung.ipservice/files/, which needs privileged access.
  • No indicators have been published for exploitation of CVE-2025-21043.

What happened#

Samsung fixed two out-of-bounds write bugs in libimagecodec.quram.so, Samsung's image-processing library, five months apart. Both let a crafted image run code remotely, and both are in CISA's KEV catalog.

CVE-2025-21043 (SVE-2025-1702) was fixed in SMR Sep-2025 Release 1. Samsung's September bulletin rates it Critical, lists Android 13 to 16, and says "Samsung was notified that an exploit for this issue has existed in the wild." It credits the "Meta and WhatsApp Security Teams", who reported it on August 13, 2025. Samsung has not said how the exploit was delivered or who was targeted. CISA added it to KEV on October 2, 2025.

CVE-2025-21042 (SVE-2024-1969) was reported on September 25, 2024 and fixed in SMR Apr-2025 Release 1 for Android 13 to 15, per the April bulletin. Both CVE records were published on September 12, 2025. On November 7, 2025, Unit 42 published LANDFALL, its analysis of DNG image files uploaded to VirusTotal from July 2024 to February 2025. They exploit CVE-2025-21042 to drop a spyware loader. Their names, such as "WhatsApp Image 2025-02-10 at 4.54.17 PM.jpeg", suggest delivery over WhatsApp, possibly zero-click. Unit 42 found no new WhatsApp flaw. It also says CVE-2025-21043 was not exploited in its samples, though the two bugs are strikingly similar. The spyware targets the Galaxy S22, S23, S24, Z Fold4 and Z Flip4. It can record audio, track location and collect photos, contacts and call logs. Unit 42 sees potential targets in Iraq, Iran, Turkey and Morocco and notes infrastructure similarities to Stealth Falcon, but makes no attribution. CISA listed the CVE on November 10, 2025.

NVD scores both 9.8. Samsung scores them 8.8, with user interaction required.

Who is affected#

Affected: Samsung devices on Android 13 to 15 before the April 2025 update (CVE-2025-21042) and on Android 13 to 16 before the September 2025 update (CVE-2025-21043), per the CVE record. Samsung does not say whether older Android releases contain the bugs. Devices that have dropped out of Samsung's update program received neither fix.

Do you really need to act?#

For phones on current updates, no. Unit 42 says there is no ongoing risk to current Samsung users. Fleets, however, often hold Galaxy phones that lag behind on updates or are out of support entirely. A single received image can be enough, so a stale Galaxy phone in the hands of an executive, journalist or official is a real exposure.

What to do now#

  1. Pull the security patch level for every Samsung device from MDM, or run adb shell getprop ro.build.version.security_patch and adb shell getprop ro.product.model. Flag anything before 2025-09-01.
  2. On the phone, open Settings > Software update > Download and install, then set a minimum patch level in your MDM compliance policy.
  3. Replace or block from corporate access any Samsung device that no longer receives security updates.

How to tell if you were hit#

Unit 42 lists six LANDFALL C2 servers, four of them last seen in August or September 2025. Search logs, for example grep -E "brightvideodesigns\.com|hotelsitereview\.com|healthyeatingontherun\.com|projectmanagerskills\.com" dns.log, and check for its IPs, such as 91.132.92.35 and 194.76.224.127. It also lists SHA-256 hashes for the DNG samples. Forensic examiners can look for b.so, l.so or aa.so under /data/data/com.samsung.ipservice/files/, which a stock phone does not expose. No indicators have been published for CVE-2025-21043. If a device matches, preserve it and get a professional forensic review.

Timeline#

  • — First LANDFALL DNG sample appears on VirusTotal, according to Unit 42.
  • — SVE-2024-1969 (CVE-2025-21042) is reported to Samsung. SMR Apr-2025 Release 1 later fixes it.
  • — Meta and WhatsApp report SVE-2025-1702 (CVE-2025-21043).
  • — Both CVE records are published. SMR Sep-2025 Release 1 carries the CVE-2025-21043 fix.
  • — CISA adds CVE-2025-21043 to KEV.
  • — Unit 42 publishes LANDFALL.
  • — CISA adds CVE-2025-21042 to KEV.

Vulnerability records

  • CVE-2025-21042 · KEV 2025-11-10 · Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
  • CVE-2025-21043 · KEV 2025-10-02 · Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Samsung Mobile Security — Android Security Updates 2025 (SMR Sep-2025) security.samsungmobile.com
  2. Samsung Mobile Security — Android Security Updates 2025 (SMR Apr-2025) security.samsungmobile.com
  3. CVE record — CVE-2025-21042 cve.org
  4. CVE record — CVE-2025-21043 cve.org
  5. NVD — CVE-2025-21042 nvd.nist.gov
  6. NVD — CVE-2025-21043 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2025-21042 cisa.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2025-21043 cisa.gov
  9. Unit 42 — LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices unit42.paloaltonetworks.com