Samsung Zero-Day Exploit CVE-2025-21043 Patched After Active Attacks on Android Devices

Samsung has released security updates to patch a critical zero-day vulnerability actively exploited against Android devices, tracked as CVE-2025-21043 with a CVSS score of 8.8, enabling remote code execution when processing malicious images.

According to Samsung’s advisory, out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code, and the patch fixed the incorrect implementation; Samsung also confirmed that an exploit for this issue has existed in the wild.

While Samsung has not disclosed technical details of the active campaigns, security experts note that the vulnerability is triggered through maliciously crafted images processed by the vulnerable library, with the attacks potentially extending beyond a single service.

The attacks, which leveraged a vulnerability in an image parsing library (CVE-2025-21043), may have targeted other instant messaging apps besides WhatsApp that use the same library, and any messenger or application relying on libimagecodec.quram.so could be a potential vector. This patch follows Google’s recent announcement of two Android vulnerabilities exploited in targeted attacks, and users are urged to update to the September 2025 Samsung Mobile Security Release 1 (SMR Sep-2025).