CVE-2026-21096

CVE-2026-21096 is a heap-based buffer overflow in the JPEG decoder of libimagecodec.quram.so, the Quram image codec library used in Samsung's stock image handling on mobile devices. The flaw is triggered when the device processes a maliciously crafted JPEG image; the CVSS 4.0 vector indicates a network-adjacent/remote attack with no privileges or user interaction required, though certain attack preconditions (AT:P) must be satisfied. A successful exploit allows a remote attacker to execute arbitrary code on the device, with high impact to confidentiality, integrity, and availability. All Samsung mobile devices that have not received the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1) are affected. There is currently no CISA KEV listing, no public proof-of-concept, and no known exploitation in the wild.

What to do: Update affected Samsung devices to the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1) via Settings > Software update, and verify the device's security patch level is September 2026 or later. Until patched, treat JPEG images from untrusted sources (e.g., email, messaging, and web downloads) as untrusted input, since decoding is the attack surface. Defenders should monitor Samsung's security advisory for any updated exploitation status.