Which versions of Samsung Quram Codec are affected by CVE-2026-21045?

Samsung mobile devices running outdated software builds contain a remote unauthenticated vulnerability (CVE-2026-21045, CVSS 8.3) in the Quram image codec that allows attackers to corrupt device…

How to fix or mitigate CVE-2026-21045?

24 hours: Inventory all Samsung mobile devices using MDM/asset management tools, identify devices running builds prior to SMR Jul-2026 Release 1, and establish monitoring for device crashes or unexplained reboots. 7 days: Implement interim controls via MDM-disable automatic TIFF image rendering in email and messaging applications, block TIFF file attachments at email gateways, and contact Samsung for confirmation of Jul-2026 Release 1 patch availability. 30 days: Deploy Samsung SMR Jul-2026 Release 1 or later to all identified vulnerable devices, verify deployment completion across the entire affected fleet.

Samsung Quram Codec CVE-2026-21045

Q: What is the CVSS score of CVE-2026-21045?

CVE-2026-21045 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42816 HIGH

2026-07-10 mobile.security@samsung.com

GHSA-rw4v-99fx-2m8m

Buffer Overflow

8.3

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote crafted image but reaching the TIFF parser is a real precondition, so AC:H; no auth or interaction (PR:N/UI:N); memory-write gives I:H, minor A:L, no C impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:41 vuln.today

DescriptionCVE.org

Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.

AnalysisAI

Out-of-bounds memory write in the Quram image codec (libimagecodec.media.quram.so) used by Samsung mobile devices allows remote attackers to corrupt memory while the library parses a malformed TIFF image, affecting builds prior to SMR Jul-2026 Release 1. Reported by Samsung's own mobile security team, the flaw carries a CVSS 4.0 base score of 8.3 (High) with a network vector and no privileges or user interaction required, though an attack requirement (AT:P) indicates a specific precondition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is libimagecodec.media.quram.so, the closed-source Quram image-decoding library integrated into Samsung's Android image/media stack and invoked whenever the platform decodes graphics such as thumbnails, messaging attachments, or gallery previews. The vulnerability is an out-of-bounds write (CWE-787 class; the NVD CWE field is unpopulated) triggered specifically in the TIFF format parser, meaning attacker-controlled fields in a crafted TIFF (e.g. tag counts, offsets, or strip/tile dimensions) drive a write past the bounds of an allocated buffer. Because native image codecs frequently execute in privileged media or system processes on Android, memory corruption here can undermine memory integrity of the decoding process.

RemediationAI

Vendor-released patch: SMR Jul-2026 Release 1 - apply the July 2026 Samsung Maintenance Release (or later) via the device's software update mechanism as the primary fix, consulting the advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07 for the exact patch level and covered models. As interim compensating controls where patching is delayed, disable auto-download/auto-preview of media in messaging apps (MMS/RCS/third-party messengers) so a TIFF is not decoded without user action, and avoid opening TIFF attachments or images from untrusted senders; the trade-off is reduced messaging convenience and loss of inline previews. Restricting sideloaded apps and untrusted image sources reduces additional decode paths but does not eliminate messaging-borne exposure.