Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks

Samsung has released its monthly Android security updates, including a fix for CVE-2025-21043, a high-severity out-of-bounds write that could allow remote code execution. The vulnerability, which carries a CVSS score of 8.8, affects the libimagecodec.quram.so component and could be exploited to run arbitrary code. According to Samsung in its advisory, the issue involves an out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1, and the patch fixes the incorrect implementation.

The vulnerability was privately disclosed to Samsung on 13 August 2025, and Samsung noted that an exploit for this issue has existed in the wild. The critical flaw affects Android versions 13, 14, 15 and 16, and the disclosure comes shortly after Google patched two other flaws (CVE-2025-38352 and CVE-2025-48543) exploited in targeted attacks.