CISA Issues Alert on Samsung 0-Day RCE Flaw Actively Exploited in Attacks

CISA has added a critical remote code execution vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities (KEV) catalog, signalling active exploitation in the wild. Tracked as CVE-2025-21042, the zero-day flaw resides in Samsung’s libimagecodec library and could allow attackers to bypass security protections and execute arbitrary code directly on vulnerable devices.

The vulnerability stems from an out-of-bounds write weakness in the libimagecodec.quram.so library, a component responsible for processing image files on Samsung devices. This remote exploitation capability means attackers do not require physical access or user interaction beyond minimal interaction with malicious content. CISA has set the remediation deadline for this vulnerability as 1 December 2025, giving users three weeks to apply security patches or implement protective measures.

The agency’s KEV listing confirms active exploitation, though specific attack details remain limited, and the vulnerability has not been confirmed as part of organised ransomware campaigns. Samsung device users should prioritise immediate action, applying patches when available and monitoring device activity for signs of compromise, with extra controls recommended for enterprise environments. according to CISA