Galaxy S25: A TIFF File Can Trigger Remote Code Execution

CVE-2026-21045 strikes the Galaxy S25's Quram library. Heap overflow in TIFF parsing carries a CVSS 8.4 score, with a three-month gap between discovery and patch.

The TrendAI Zero Day Initiative published advisory ZDI-26-529 on August 11, 2026, detailing a heap-based buffer overflow in TIFF file processing on the Samsung Galaxy S25. The flaw, tracked as CVE-2026-21045 and fixed in the SMR Jul-2026 Release 1, enables remote arbitrary code execution with a CVSS 4.0 score of 8.4. The roughly three-month gap between vendor notification and public disclosure leaves a documented exposure window for unpatched devices.

Key Takeaways

The vulnerability resides in libimagecodec.media.quram.so, a third-party image codec library Samsung integrates into the Galaxy S25 firmware.
The mechanism is a heap-based buffer overflow caused by missing validation of user-supplied data length before copying it into memory, resulting in an out-of-bounds write.
According to the official CVE record, the score is 8.4 HIGH with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N, confirming severe impact on integrity.
Exploitation requires user interaction: opening a malicious TIFF file or visiting a web page that serves one.

The Quram Library and the Hidden Danger of Image Codecs

The core of the flaw is libimagecodec.media.quram.so, a Quram-supplied library integrated into Samsung firmware for image format decoding. The official CVE record, curated by the Samsung Mobile CNA, explicitly describes the vulnerability as an "out-of-bounds write in parsing TIFF format" in versions prior to SMR Jul-2026 Release 1. The ZDI advisory adds the decisive technical detail: the lack of proper validation of the length of user-supplied data before copying it to a heap-allocated buffer.

The architectural choice to delegate TIFF parsing to a third-party library is not unusual in the mobile industry: manufacturers integrate specialized components to handle the multiplicity of formats without developing proprietary parsers for each. The documented case highlights, however, the fragility of this supply chain: a defect in a library with low visibility becomes a full-compromise vector on the flagship device of the world's largest Android maker.

Attack Mechanism: From TIFF File to Code Execution

Advisory ZDI-26-529 states the stakes clearly: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S25 devices." The technical specification continues: "The specific flaw exists within the processing of TIFF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer."

Controlled overwrite of heap memory allows diversion of the image decoding process execution flow, typically running with media server privileges. The attack vector is low-complexity for the attacker: the TIFF file can be distributed as an attachment, downloaded via browser, or potentially embedded in a web rendering stream. The only requirement is user interaction, which ZDI qualifies as a necessary condition: "User interaction may be required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file."

The Three-Month Gap Between Discovery and Protection

The documented timeline shows a coordinated disclosure following responsible disclosure norms: vendor notification on May 6, 2026, patch release in the July 2026 Security Maintenance Release, and public ZDI advisory publication on August 11, 2026. This interval of roughly three months represents the theoretical exposure window for users who have not promptly applied the update.

The official CVE record confirms the fix status with the wording "unaffected at SMR Jul-2026 Release." The Samsung SMR Jul-2026 advisory, while not a dedicated page for the single vulnerability, includes entry SVE-2026-1087 with a description identical to the CVE record: same library, same out-of-bounds write mechanism in TIFF parsing, same fix release. Researcher Dvir Gozlan, in collaboration with ZDI, is credited for this report in the Samsung bulletin.

"Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory."
— CVE-2026-21045 Record, CNA Samsung Mobile

Why It Matters

The dossier does not specify whether other Samsung models share the same vulnerable Quram library; available documentation is limited to the Galaxy S25. The presence of in-the-wild exploits is not documented, nor is it clear whether the TIFF component is reachable via inline browser rendering without an explicit user download.

The source does not detail the exact nature of privileges obtainable post-exploitation beyond the current process context. No infrastructure overlaps link this vulnerability to specific threat actors at this time. The ZDI record does not specify an individual researcher name in the credit field, limiting attribution to the institutional collaboration with the TrendAI Zero Day Initiative.

What to Do Now

Verify installation of SMR Jul-2026 Release 1 or later on corporate and personal Galaxy S25 devices.
Review attachment-handling workflows for TIFF image formats in corporate email and messaging channels.
Check automatic update logs across the mobile fleet to identify units that missed the July 2026 patch.
Evaluate network segmentation for unpatched mobile devices accessing sensitive resources until fix application is confirmed.

Frequently Asked Questions

Why does a TIFF format, typically used in professional and scanner contexts, pose a risk on smartphones?

The CVE record and ZDI advisory indicate that the libimagecodec.media.quram.so library handles TIFF parsing in the device operating system. A TIFF file received through any channel — attachment, browser, third-party app — triggers the vulnerable decoder regardless of the format's typical user profile.

Does the CVSS 8.4 HIGH score imply the attack is immediate and unhindered?

The documented CVSS:4.0 vector includes AT:P (Attack Requirements: Present) and the user interaction requirement explicitly stated by ZDI. The score reflects the severity of the impact on integrity (VI:H) more than the ease of unconditional exploitation.

Is updating the device sufficient, or are additional measures needed?

The dossier documents exclusively the availability of the fix in SMR Jul-2026 Release 1. The source does not specify supplementary remedial measures or manual mitigation actions beyond applying the official Samsung patch.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references