ZDI-26-529: Samsung Galaxy S25 TIFF File Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI discloses CVE-2026-21045, a heap buffer overflow in Samsung Galaxy S25 TIFF processing enabling RCE via malicious files or pages.
ZDI-26-529 describes a heap-based buffer overflow in Samsung Galaxy S25 TIFF file processing that allows remote attackers to execute arbitrary code. User interaction is required, as the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 8.8, tracked as CVE-2026-21045.
- Heap buffer overflow in Samsung Galaxy S25 TIFF file processing
- Remote code execution possible with user interaction
- CVSS 8.8, tracked as CVE-2026-21045
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21045 | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds… | 8.3 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S25 devices. User interaction may be required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.