EUVD-2026-74636
GHSA-fgp3-964j-h4rh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via delivered image with no auth or explicit interaction, but the required crafted-DNG precondition (AT:P in 4.0) maps to AC:H in 3.1; full code-execution impact gives C/I/A:H.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
AnalysisAI
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that a Samsung device running an affected Android 14-17 build (pre-SMR Sep-2026 Release 1) parse an attacker-supplied DNG image through libimagecodec.quram.so - i.e., the malicious DNG must be delivered and processed via a media pathway (messaging preview/thumbnail, gallery, or media scan). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.2) rates this network-reachable, unauthenticated, no user interaction, with full confidentiality/integrity/availability impact - the AT:P (Attack Requirements: Present) qualifier is the key nuance, signaling that a specific precondition (the victim's device must receive and process a malicious DNG through a media pathway) is required rather than being freely repeatable against any endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Install the Samsung SMR Sep-2026 Release 1 firmware update (Vendor-released patch: SMR Sep-2026 Release 1) via Settings → Software update → Download and install, once it is available for the specific model - this is the definitive fix and the version cited in the Samsung bulletin (https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Samsung devices running Android 14-17 within your organization and communicate the vulnerability to users and BYOD administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today