Samsung has fixed CVE-2025-21043, a zero-day vulnerability that allowed remote code execution on Android devices through a third-party codec library. The report came from Meta and WhatsApp security teams on August 13, 2025, not through the traditional vulnerability disclosure channel to the device vendor. This chain of responsibility illustrates an ecosystem where the line between who discovers, who patches, and who protects the end user is increasingly blurred.
- CVE-2025-21043 is an out-of-bounds write in the
libimagecodec.quram.solibrary enabling remote RCE on Samsung Android devices running versions prior to SMR Sep-2025 Release 1. - The vulnerability was actively exploited in zero-day attacks before the fix.
- Meta and WhatsApp security teams reported the flaw on August 13, 2025, documenting an unusual cross-vendor threat intelligence role for this class of bug.
- WhatsApp sent threat notifications to users potentially targeted by an advanced spyware campaign over the last 90 days, though the source does not establish direct causality with CVE-2025-21043.
An Image Parser as Entry Point
The technical core lies in libimagecodec.quram.so, a codec library developed by Quram and integrated by Samsung into its devices. It is a multimedia parsing component that processes image files: a historically fertile attack surface because parsers must handle complex formats, non-standard variants, and potentially malformed input.
The flaw is classified as an out-of-bounds write. A remote attacker can exploit it to corrupt process memory and execute arbitrary code. The exact nature of the vector — whether it requires user interaction to open a file or can trigger without interaction — is not specified by the source. This uncertainty has concrete operational implications: where interaction is required, the risk profile changes significantly compared to a zero-click scenario.
"Samsung fixed the remote code execution flaw CVE-2025-21043 that was exploited in zero-day attacks against Android devices." — Security Affairs
Who Discovers and Who Protects: The Role of Meta and WhatsApp
On August 13, 2025, Meta and WhatsApp security teams sent the report to Samsung. This dynamic is rare: typically, vulnerabilities in OS components or third-party libraries are discovered by independent researchers, security vendors, or the manufacturer itself. Here, a social media and messaging company identified and documented a bug in a codec library of a competing hardware vendor.
In late August 2025, WhatsApp sent threat notifications to individuals it believes were targeted by an "advanced" spyware campaign over the last 90 days. The source places this news alongside the description of CVE-2025-21043 but does not establish that the Samsung vulnerability is the specific vector of that campaign. This textual proximity, not declared as causality, must be read with caution: it is possible the two pieces of information are contextual rather than connected.
The Patch and the Visibility Problem
According to the primary source, the fix is available starting with SMR Sep-2025 Release 1 (Security Maintenance Release). The official Samsung security updates page, consulted as a supporting source, shows only 2026 SMRs in the extracted text: this makes the actual distribution of the patch to all affected models unverifiable from the outside at this time. The dossier does not specify which devices receive the update or whether some models remain uncovered.
This opacity is recurring in Android patch management. Samsung manages its own SMR program independently of Google's monthly update cycle, but the fragmentation of models, regional variants, and carriers introduces latency and coverage gaps that the source does not quantify.
Why It Matters
The dossier does not specify the number of potentially exposed devices, the exact nature of observed payloads, or the threat actor group behind the zero-day attacks. It also does not document whether the spyware campaign flagged by WhatsApp actually exploited CVE-2025-21043 or whether the two news items are merely temporally overlapping.
The source does not list specific remedial measures beyond installing SMR Sep-2025 Release 1, nor does it provide indicators of compromise to verify if a device was targeted. It is unclear whether WhatsApp released its own patches or if its statement that it had "already patched the flaw exploited by the attackers" refers to a different bug in its own application.
What the dossier documents unequivocally is the supply chain structure: a third-party library (Quram), integrated by a hardware vendor (Samsung), discovered by a consumer software actor (Meta/WhatsApp) that manages the direct relationship with the end user through threat notifications. This layering makes traditional patching insufficient to guarantee protection: the point of contact with the user is not the entity that holds the bug, but the one with visibility into the abuse.
For the industry, the case confirms that multimedia parsers remain a priority attack surface for commercial spyware and APT campaigns. The complexity of image formats, the presence of third-party libraries often not subject to extensive audits, and deep integration into the operating system create a dependency chain where the security of each link conditions that of all the others.
Information is based on the cited advisory and current as of publication.
Sources
- https://securityaffairs.com/182135/hacking/samsung-fixed-actively-exploited-zero-day.html
- https://security.samsungmobile.com/securityUpdate.smsb
- https://securityaffairs.com/
- https://securityaffairs.com/extended-cookie-policy
Information is based on the cited source and current as of publication.