---
title: "Samsung Image Library Zero-Days CVE-2025-21042/21043"
url: https://erroneo.us/security/briefs/samsung-libimagecodec-quram-cve-2025-21042-21043-landfall/
description: "Two exploited bugs in Samsung's libimagecodec.quram.so, one used by LANDFALL spyware. Fixed in SMR Apr-2025 and Sep-2025. Find lagging Galaxy phones."
type: security-brief
section: "Security Digest"
date_published: 2025-09-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-21042", "CVE-2025-21043"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Samsung Image Library Zero-Days CVE-2025-21042/21043

**Verdict: Check exposure.** Both bugs were fixed in 2025 and phones that took updates are safe, but Galaxy devices with a security patch level before September 2025, including models Samsung no longer updates, remain open to image-borne spyware.

- **Who must act:** Anyone managing Samsung Galaxy phones or tablets on Android 13 to 16 with a security patch level before September 2025, especially Galaxy S22, S23, S24, Z Fold4 and Z Flip4 units used by people likely to be targeted.
- **Who can relax:** Samsung devices on SMR Sep-2025 Release 1 or any later security update; phones from other Android vendors are not covered by these Samsung advisories.
- **Affected:** Samsung devices on Android 13, 14 and 15 before SMR Apr-2025 Release 1 (CVE-2025-21042); Samsung devices on Android 13, 14, 15 and 16 before SMR Sep-2025 Release 1 (CVE-2025-21043)
- **Fixed:** SMR Apr-2025 Release 1 (CVE-2025-21042); SMR Sep-2025 Release 1 (CVE-2025-21043, and includes the April fix)
- **CVEs:** CVE-2025-21042, CVE-2025-21043
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull the Android security patch level for every Samsung device from MDM, or run adb shell getprop ro.build.version.security_patch, and flag anything before 2025-09-01.
2. Install the latest available Samsung security update on flagged devices and set a minimum patch level in your MDM compliance policy.
3. Replace or block from corporate access Samsung devices that no longer receive monthly or quarterly security updates.
4. For high-risk users, prioritize the Galaxy S22, S23, S24, Z Fold4 and Z Flip4 models that LANDFALL was built for.

### How to check if you are affected

- Search DNS, proxy and firewall logs for the LANDFALL C2 servers Unit 42 published: brightvideodesigns[.]com, hotelsitereview[.]com, healthyeatingontherun[.]com, projectmanagerskills[.]com and their IPs.
- Hash-match received images against Unit 42's published DNG sample hashes; the files carry WhatsApp-style names such as IMG-20240723-WA0000.jpg.
- On a device examined forensically, look for LANDFALL files (b.so, l.so, aa.so) under /data/data/com.samsung.ipservice/files/, which needs privileged access.
- No indicators have been published for exploitation of CVE-2025-21043.

## What happened

Samsung fixed two out-of-bounds write bugs in `libimagecodec.quram.so`, Samsung's image-processing library, five months apart. Both let a crafted image run code remotely, and both are in CISA's KEV catalog.

**CVE-2025-21043** (SVE-2025-1702) was fixed in SMR Sep-2025 Release 1. Samsung's [September bulletin](https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09) rates it Critical, lists Android 13 to 16, and says "Samsung was notified that an exploit for this issue has existed in the wild." It credits the "Meta and WhatsApp Security Teams", who reported it on August 13, 2025. Samsung has not said how the exploit was delivered or who was targeted. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21043) on October 2, 2025.

**CVE-2025-21042** (SVE-2024-1969) was reported on September 25, 2024 and fixed in SMR Apr-2025 Release 1 for Android 13 to 15, per the [April bulletin](https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04). Both CVE records were published on September 12, 2025. On November 7, 2025, Unit 42 published [LANDFALL](https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/), its analysis of DNG image files uploaded to VirusTotal from July 2024 to February 2025. They exploit CVE-2025-21042 to drop a spyware loader. Their names, such as "WhatsApp Image 2025-02-10 at 4.54.17 PM.jpeg", suggest delivery over WhatsApp, possibly zero-click. Unit 42 found no new WhatsApp flaw. It also says CVE-2025-21043 was not exploited in its samples, though the two bugs are strikingly similar. The spyware targets the Galaxy S22, S23, S24, Z Fold4 and Z Flip4. It can record audio, track location and collect photos, contacts and call logs. Unit 42 sees potential targets in Iraq, Iran, Turkey and Morocco and notes infrastructure similarities to Stealth Falcon, but makes no attribution. CISA listed the CVE on November 10, 2025.

[NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-21042) scores both 9.8. Samsung scores them 8.8, with user interaction required.

## Who is affected

Affected: Samsung devices on Android 13 to 15 before the April 2025 update (CVE-2025-21042) and on Android 13 to 16 before the September 2025 update (CVE-2025-21043), per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-21043). Samsung does not say whether older Android releases contain the bugs. Devices that have dropped out of Samsung's update program received neither fix.

## Do you really need to act?

For phones on current updates, no. Unit 42 says there is no ongoing risk to current Samsung users. Fleets, however, often hold Galaxy phones that lag behind on updates or are out of support entirely. A single received image can be enough, so a stale Galaxy phone in the hands of an executive, journalist or official is a real exposure.

## What to do now

1. Pull the security patch level for every Samsung device from MDM, or run `adb shell getprop ro.build.version.security_patch` and `adb shell getprop ro.product.model`. Flag anything before `2025-09-01`.
2. On the phone, open Settings > Software update > Download and install, then set a minimum patch level in your MDM compliance policy.
3. Replace or block from corporate access any Samsung device that no longer receives security updates.

## How to tell if you were hit

Unit 42 lists six LANDFALL C2 servers, four of them last seen in August or September 2025. Search logs, for example `grep -E "brightvideodesigns\.com|hotelsitereview\.com|healthyeatingontherun\.com|projectmanagerskills\.com" dns.log`, and check for its IPs, such as `91.132.92.35` and `194.76.224.127`. It also lists SHA-256 hashes for the DNG samples. Forensic examiners can look for `b.so`, `l.so` or `aa.so` under `/data/data/com.samsung.ipservice/files/`, which a stock phone does not expose. No indicators have been published for CVE-2025-21043. If a device matches, preserve it and get a professional forensic review.

## Timeline

- Jul 23, 2024 — First LANDFALL DNG sample appears on VirusTotal, according to Unit 42.
- Sep 25, 2024 — SVE-2024-1969 (CVE-2025-21042) is reported to Samsung. SMR Apr-2025 Release 1 later fixes it.
- Aug 13, 2025 — Meta and WhatsApp report SVE-2025-1702 (CVE-2025-21043).
- Sep 12, 2025 — Both CVE records are published. SMR Sep-2025 Release 1 carries the CVE-2025-21043 fix.
- Oct 2, 2025 — CISA adds CVE-2025-21043 to KEV.
- Nov 7, 2025 — Unit 42 publishes LANDFALL.
- Nov 10, 2025 — CISA adds CVE-2025-21042 to KEV.

## Sources

1. [Samsung Mobile Security — Android Security Updates 2025 (SMR Sep-2025)](https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09)
2. [Samsung Mobile Security — Android Security Updates 2025 (SMR Apr-2025)](https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04)
3. [CVE record — CVE-2025-21042](https://www.cve.org/CVERecord?id=CVE-2025-21042)
4. [CVE record — CVE-2025-21043](https://www.cve.org/CVERecord?id=CVE-2025-21043)
5. [NVD — CVE-2025-21042](https://nvd.nist.gov/vuln/detail/CVE-2025-21042)
6. [NVD — CVE-2025-21043](https://nvd.nist.gov/vuln/detail/CVE-2025-21043)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-21042](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21042)
8. [CISA — Known Exploited Vulnerabilities: CVE-2025-21043](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21043)
9. [Unit 42 — LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices](https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/)

---
Source page: https://erroneo.us/security/briefs/samsung-libimagecodec-quram-cve-2025-21042-21043-landfall/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt