Skip to main content
Apexward Pulse

Samsung · Memory corruption

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CVE-2025-21042

What this means

This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Samsung Android is in your estate, and treat that as the priority.

Full vendor description

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

Scoring and exploitation

8.8/ 10
CVSS 3.1 base scoreHigh

Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~33.2% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Samsung Mobile Devices

Weaknesses

CWE-787

Affected products ()

  • Samsung Android
Show the raw CPE strings (40)
  • cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-apr-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-apr-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-apr-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-aug-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-aug-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-aug-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-dec-2021-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-dec-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-dec-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-feb-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-feb-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-feb-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-feb-2025-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jan-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jan-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jan-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jan-2025-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jul-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jul-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jul-2024-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jun-2022-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jun-2023-r1:*:*:*:*:*:*
  • cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1:*:*:*:*:*:*

Showing 25 of 40 matches from .

References

3 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events