Samsung fixed actively exploited zero-day

Samsung fixed the remote code execution flaw CVE-2025-21043, which was exploited in zero-day attacks against Android devices. The flaw is an out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1, and a remote attacker can exploit it to execute arbitrary code, according to Meta and WhatsApp. Samsung released a patch to fix the incorrect implementation, and in late August WhatsApp sent threat notifications to individuals they believe were targeted by an advanced spyware campaign.

The notifications warned that a malicious message may have exploited OS flaws to compromise devices and data, with the attack requiring no user interaction. Amnesty researchers indicate the attack also involved an authorization bypass issue tracked as CVE-2025-55177 in WhatsApp on iOS and Mac, while the exploit allowed content from arbitrary URL to be rendered; such campaigns are associated with threat actors that are typically well-resourced, including state-sponsored groups.