Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
We need answer JSON only. Need synthesize. Need follow precision. Let's parse input. CVE-2026-71801 description: s-pms SPMS-Server through v1.0 hardcoded default access token secret core config file, not overridden/removed production. Remote unauthenticated attacker can locally forge valid admin session tokens bypass auth gaining full unauthorized access to protected backend APIs. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798 hardcoded credentials. EPSS 0.24% percentile 15. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (bad). Tags: Authentication Bypass, N A. EUVD. References: github issue, nvd. Need output fields. product_name: "SPMS-Server" maybe 1-3 words. s-pms SPMS-Server. Could be "SPMS-Server". Summary: original synthesis. Don't copy description. Start with specific impact verb and product. E.g. "Authentication bypass in SPMS-Server through v1.0 allows remote unauthenticated attackers to forge administrative session tokens and access protected backend APIs." Mention hardcoded default token secret, not overridden production. No KEV, no POC? POC? References github issue maybe vulnerability report not POC? Input does not have POC explicitly. Need not claim POC exists. EPSS low 0.24 percentile 15. "No public exploit identified at time of analysis" though GitHub issue maybe report. Need use only phrases. KEV not present. Use "no public exploit identified at time of analysis". But maybe references include github issue; it's vulnerability disclosure not necessarily exploit. We can mention POC status? Need no. Technical_context: CWE-798 Use of Hard-coded Credentials. Underlying auth likely token-based with secret stored in config. CPE is n/a but affected product is SPMS-Server through v1.0. Explain hardcoded default access token secret in core config; not overridden production profile leads to token forgery. Use CWE. risk_assessment: Assess CVSS 9.8 critical, AV:N/AC:L/PR:N/UI:N, high C/I/A. EPSS 0.24 percentile 15 suggests low likelihood of wid
We need answer JSON only. Need synthesize. Need be careful precision. Let's parse input. CVE-2026-87595 description: SSRF in Mobile in Google Chrome prior to 153.0.8010.36 allowed remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H given. CWE-918. EPSS 0.18% percentile 7%. Patch available from vendor. Tags Google, SSRF. CPE google chrome. Affected versions EUVD: ["Chrome 153.0.8010.36 <153.0.8010.36"] weird, maybe means prior to 153.0.8010.36. References. Need output fields. product_name: Google Chrome. summary: original synthesis not copy. Mention SSRF in Chrome Mobile prior 153.0.8010.36, remote attacker leveraging social engineering bypass access restrictions via crafted HTML. Chromium severity low despite CVSS 9.8. EPSS low, no KEV, no POC. Need say no public exploit identified. "confirmed actively exploited"? no KEV absent. POC absent. Use phrase "no public exploit identified at time of analysis". Could say "Although CVSS score is 9.8, Chromium rates severity Low; EPSS is 0.18%". Need uncertainty: CVSS vector conflict with description: AV:N PR:N UI:N vs description says social engineering = user interaction likely. We need state this explicitly in risk and confidence. CVSS says UI:N and high impact, but description says leveraging social engineering and Chromium severity low. Maybe SSRF impact could be high? But likely CVSS is incorrect? We can use own assessed vector maybe UI:R due social engineering, maybe AC:L? Let's determine assessed CVSS. Vulnerability: SSRF in Mobile in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering via crafted HTML page to bypass system access restrictions. SSRF means server-side request forgery in Chrome Mobile? The browser is client? "Mobile" component. Attack vector network? User interaction required because social engineering to visit crafted HTML page. So AV:N AC:L PR:N UI:R
Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. No public exploit is confirmed beyond the referenced GitHub issue writeup, and EPSS remains low (0.18%) despite the maximal CVSS of 9.8.
Missing authorization in the WebView component of Google Chrome on Android before 153.0.8010.36 lets a remote attacker who first tricks a user via social engineering bypass system access restrictions through crafted network traffic. The flaw is tracked as CWE-862 (missing authorization) and was reported by Google's Chrome team; a vendor patch is available. Chromium rates the security severity as Medium, EPSS is low (0.17%), and no public exploit or CISA KEV listing has been identified.
Incorrect authorization in the Extensions component of Google Chrome before 153.0.8010.36 allows a remote attacker to bypass system access restrictions and reach a privileged internal page by luring a victim to a crafted HTML page. Google credits its own team with discovery, and a fixed build is available; no public exploit has been identified at time of analysis, and Chromium rated the underlying issue only Low severity despite the 9.8 NVD score.
Arbitrary code execution in Actions Semiconductor's Tool - Media Player Utilities v4.46 lets a physically proximate attacker run code on a host by abusing the Production.dll and RdiskUpgrade.exe firmware/disk-upgrade components (CWE-94 code injection). The flaw affects this specific flashing/production utility bundled with Actions Semiconductor media-player SoC toolchains. SSVC rates technical impact as total with a public proof-of-concept, but EPSS is only 0.17% (6th percentile), and the required physical/local proximity sharply limits real-world reach.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 arises from an out-of-bounds write in the WebGL graphics subsystem, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, the scope-changed vector reflects a full sandbox escape. No public exploit is identified at time of analysis and EPSS is low (0.39%), but WebGL memory-corruption bugs are historically high-value targets.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a heap buffer overflow in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can corrupt heap memory and execute arbitrary code outside the renderer sandbox, gaining full compromise of the host. No public exploit is identified at time of analysis and EPSS is low (0.33%), but the sandbox-escape scope and Chrome's near-universal footprint make prompt patching essential.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Sandbox-escape remote code execution in Google Chrome for Android before 153.0.8010.36 arises from an integer overflow in the GPU process, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. Fixed in the same 153.0.8010.36 Stable Channel release that addressed several other GPU/media memory-safety bugs; no public exploit identified at time of analysis. Note the rating tension: the input CVSS is 9.6 (Critical) while Google's own Chromium severity is only Medium.
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from incorrect reference resolution in the FileSystem component, letting a remote attacker who lures a victim into visiting a crafted HTML page run arbitrary code outside the renderer sandbox. Reported by Google's own Chrome team and patched in the 2026-09 stable-channel desktop update; no public exploit is identified and SSVC lists exploitation as none, with EPSS at a modest 0.32%. Note a signal conflict: Chromium rates this 'Medium' while the assigned CVSS is 9.6, and the description requires user interaction (social engineering), so real-world risk is lower than the raw score suggests.
Sandbox-escape remote code execution affects Google Chrome on macOS prior to 153.0.8010.36, where an improper quantity-validation flaw (CWE-1284) in Tint, the WebGPU/WGSL shader compiler in Chromium's Dawn graphics stack, lets a crafted HTML page break out of the renderer sandbox. A remote attacker who lures a victim to a malicious web page can potentially execute arbitrary code with the privileges of the browser process on the host. Google reports a fix is shipped; there is no public exploit identified at time of analysis, and Chromium internally rated the issue Medium severity despite the high provided CVSS.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Remote code execution in Google Chrome prior to 153.0.8010.36 allows a remote attacker to escape the renderer sandbox and run arbitrary code on the host by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebGL implementation. Chromium rates this Critical and the CVSS 9.6 score reflects a scope-changing sandbox escape; no public exploit is identified at time of analysis, and EPSS is low at 0.29% (21st percentile). Patched in the September 2026 stable-channel desktop release.
Stored cross-site scripting in SkillTree (NSA skills-service) before 4.4.2 lets an unauthenticated attacker self-register with a malicious firstName/lastName/nickname that executes in an administrator's browser when they open the Quiz Runs page. Because registration fields are stored unsanitized and later rendered through Vue's v-html directive, the flaw escalates from simple alert() proof to remote script loading via import() and full XSRF-token theft, enabling any admin action (delete projects, create backdoor accounts, exfiltrate user data). Publicly detailed in the GitHub Security Advisory; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from a numeric truncation error in the Media component, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The vendor patch is available via the September 2026 stable-channel update; no public exploit is identified at time of analysis. Note a signal conflict: Chromium rated this 'Medium' severity while the supplied CVSS base score is 9.6 Critical.
Out-of-bounds write in the Media component of Google Chrome before 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the browser's renderer sandbox by luring a victim to a crafted HTML page. The scope-changing memory-corruption bug carries a CVSS of 9.6 despite Chromium's own 'Medium' severity rating, and a vendor patch is available. There is no public exploit identified at time of analysis.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Out-of-bounds read in the WebGL component of Google Chrome before 153.0.8010.36 lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates the security severity as High, and a vendor patch is available; no public exploit has been identified and CISA SSVC records exploitation as none, with EPSS at a low 0.28% (20th percentile).
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome on Windows prior to 153.0.8010.36 arises from a type-confusion bug in the browser's Rust code, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google shipped a fixed build via the Stable channel, and the flaw was reported internally by the Chrome team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though sandbox-escape memory-corruption bugs in Chrome are historically high-value exploitation targets.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Sandbox-escaping remote code execution in Google Chrome before 153.0.8010.36 stems from improper array-index validation (CWE-129) in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; no public exploit is identified at time of analysis and EPSS is low (0.21%).
Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with CISA SSVC scoring exploitation as 'none'.
Sandbox-escape remote code execution in Google Chrome (Chromium-based desktop) before 153.0.8010.36 stems from an incorrect authorization flaw in the DevTools component. A remote attacker who lures a victim to a crafted HTML page can potentially execute arbitrary code outside the renderer sandbox, achieving full compromise of the browser process. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV, but Google rates the Chromium security severity as High.
Path traversal in the Pandora malware-analysis platform (pandora-analysis, versions ≤1.12.7) lets an attacker who submits a crafted archive or disk image write extracted files outside the intended extraction directory. Because the extractor worker (ISO, BZ2, CAB, GZ, LZMA handlers) wrote decompressed content to attacker-influenced paths without confirming the destination stayed inside the target directory, a malicious sample can overwrite files accessible to the worker process, enabling file tampering, denial of service, and potential further compromise. No public exploit identified at time of analysis; the fix is present in the referenced upstream commit.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.