Samsung Mobile Devices CVE-2026-21095

Requires that a Samsung device running an affected Android 14-17 build (pre-SMR Sep-2026 Release 1) parse an attacker-supplied DNG image through libimagecodec.quram.so - i.e., the malicious DNG must be delivered and processed via a media pathway (messaging preview/thumbnail, gallery, or media scan). No authentication and no explicit user interaction are needed per the CVSS vector (PR:N/UI:N), but the AT:P attack-requirement flag means the attacker depends on the victim's device actually ingesting and decoding the crafted image; only Samsung devices bundling the Quram library are affected, and patched firmware removes the condition.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.2) rates this network-reachable, unauthenticated, no user interaction, with full confidentiality/integrity/availability impact - the AT:P (Attack Requirements: Present) qualifier is the key nuance, signaling that a specific precondition (the victim's device must receive and process a malicious DNG through a media pathway) is required rather than being freely repeatable against any endpoint. No EPSS score, KEV entry, or public POC is present in the supplied data, so raw exploitation-probability signals are absent; this argues against treating it as an active, in-the-wild threat today. However, the product footprint is enormous, native-library heap overflows in Quram/Samsung media parsers have historically become reliable RCE and even zero-click chains, and the impact rating is maximal - so this is a genuine high-priority mobile patch, not a paper-high score. AT:P and the media-delivery requirement are the main factors that keep it below a clean 'wormable remote' profile.

An attacker crafts a malicious DNG image that overflows the heap in the Quram DNG decoder and sends it to a victim via a messaging app or web content; when the device auto-generates a preview or the user opens the image, the decoder is invoked and the attacker's payload executes on the device. Given AV:N/PR:N/UI:N with AT:P, delivery via a media pipeline that auto-processes the file is the realistic path; no public POC is currently identified.