CVE-2025-21042

Name of the Vulnerable Software and Affected Versions Samsung Galaxy devices versions prior to SMR Apr-2025 Release 1

Description An out-of-bounds write issue exists in the libimagecodec.quram.so library used for image decoding. A remote attacker can exploit this by sending a specially crafted DNG (Digital Negative) image via messaging applications, such as WhatsApp. This flaw can lead to remote code execution (RCE) and full device compromise, potentially without any user interaction (zero-click). The issue was leveraged in a sophisticated spyware campaign known as Landfall, which targeted high-value individuals in the Middle East, including Iraq, Iran, Turkey, and Morocco. The Landfall spyware provides attackers with extensive access to the device, including the microphone, camera, SMS, contacts, location data, and call logs.

Recommendations Update the device firmware to the April 2025 security update or a newer version. Disable automatic multimedia downloads in messaging applications. Avoid opening DNG or RAW image files from unknown sources.