CVE-2026-21095

CVE-2026-21095 is a heap-based buffer overflow in the DNG (Digital Negative RAW) decoder of libimagecodec.quram.so, Samsung's image codec library shipped on Galaxy Android devices. The flaw is triggered when the library processes a specially crafted DNG image, and the CVSS 4.0 vector (AV:N, PR:N, UI:N) indicates it can be exploited over a network without privileges or user interaction. A successful attack allows a remote attacker to execute arbitrary code in the context of the media-processing component. All Samsung devices running a security patch level earlier than the September 2026 Samsung Maintenance Release (SMR) are affected. There is currently no known exploitation, no public proof-of-concept, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply Samsung's September 2026 Maintenance Release (SMR Sep-2026 Release 1) via Settings > Software update as soon as it is available for your device. Until patched, treat DNG/RAW images from untrusted sources (messaging apps, email attachments, cloud links) with caution, as no public PoC or in-the-wild exploitation is known. Verify your device's Android security patch level shows the September 2026 (or later) Samsung security update after installing.