Patch now: Samsung zero-day lets attackers take over your phone

A critical vulnerability has put Samsung mobile device owners at risk of sophisticated cyberattacks. On 10 November 2025, according to the Cybersecurity and Infrastructure Security Agency (CISA), CVE-2025-21042 was added to the Known Exploited Vulnerabilities (KEV) catalog, flagging active exploitation in the wild and prompting patch urgency for Federal Civilian Executive Branch agencies.

The flaw—an out-of-bounds write in Samsung’s image processing library—enabled remote code execution and, in the reported cases, the deployment of LANDFALL spyware on Galaxy devices in the Middle East via a zero-click attack using malformed DNG images sent over WhatsApp. Samsung had already patched this issue in April 2025, yet exploits have persisted in some environments, underscoring the need for immediate updating.

The article recommends patching now, avoiding unsolicited image-based files, and using real-time anti-malware, noting that FCEB organisations have until 1 December 2025 to comply with CISA’s directive. Targeted device models include Galaxy S23, S24, Z Fold4, S22 and Z Flip4.