Samsung warns of exploit in Quramsoft image library, Sept patch issued

Samsung on Monday warned Galaxy users of active attacks exploiting a critical vulnerability in a third party image library and issued an updated September security patch to fix the flaw, which the company and messaging app makers say has been used in the wild to compromise devices running Android 13 or newer. The flaw, tracked as CVE202521043, was reported to Samsung on August 13 by security teams at Meta and WhatsApp, officials said.

Samsung said the vulnerability is an out of bounds write in libimagecodec.quram.so, a closed source image parsing library from Quramsoft, and that a remote attacker could use specially crafted image files to execute arbitrary code on affected phones. The flaw was addressed in Samsung's September Security Maintenance Release. WhatsApp and other security firms also released fixes and guidance after the issue surfaced, Samsung and the messaging service said.

WhatsApp sent threat notifications in late August to some users whom it believes were targeted in an advanced spyware campaign over the preceding 90 days, the company said. WhatsApp warned that the attack chain could be triggered without any user interaction, meaning devices could be compromised...