EUVD-2026-74637
GHSA-rf4p-x369-g5c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious JPEG image
-
DeliveryDeliver via message/email/web preview
-
ExploitCodec parses, triggers heap overflow
-
ExecutionGroom heap to control corruption
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target device to decode an attacker-supplied JPEG using the vulnerable libimagecodec.quram.so on a Samsung firmware build prior to SMR Sep-2026 Release 1 (Android 14/15/16/17). Per CVSS PR:N/UI:N the attack needs no authentication and no explicit user interaction, consistent with automatic image processing (preview/thumbnail paths); however, AT:P signals a concrete attack requirement - reliable code execution depends on achieving a favorable heap state (grooming/layout, likely ASLR bypass), so exploitation is not a single deterministic shot. Limiting factors: only Samsung devices shipping this Quram codec are affected, and patched builds (SMR Sep-2026 R1+) are not vulnerable. |
| Impact | The Samsung CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) describes an unauthenticated, network-reachable, no-user-interaction memory-corruption bug with full confidentiality, integrity, and availability impact on the vulnerable system - a genuinely high-priority profile for a consumer device fleet of this scale. The one tempering signal is AT:P (attack requirements present), which indicates the overflow is not trivially deterministic: successful code execution likely depends on heap grooming, ASLR defeat, or a specific memory layout rather than a single guaranteed-fatal packet. Balanced against that, image-parser RCE on ubiquitous mobile hardware is exactly the class of bug historically weaponized for zero-click delivery, so it should be patched promptly despite the absence of a public exploit, EPSS data, or KEV listing in the provided intelligence. No EPSS score was supplied, so exploitation-probability modeling cannot be cross-referenced here, and the RCE assessment rests on Samsung's own advisory rather than an independent PoC. |
| Exploit ScenarioDerived | An attacker crafts a malformed JPEG that triggers the heap overflow and sends it to a target Samsung device - for example embedded in a message, email, or web page that the device decodes to generate a preview or thumbnail. When the Quram codec parses the image, the overflow corrupts heap memory and, after appropriate heap manipulation (reflecting the AT:P attack requirement), allows the attacker to execute arbitrary code on the device. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).
RemediationAI
Apply the vendor-released patch: install SMR Sep-2026 Release 1 (or later) for the applicable Android 14/15/16/17 base via Settings > Software update, as published in Samsung's September 2026 security bulletin (https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09). No official pre-patch workaround is documented; as interim compensating controls, avoid opening or previewing images from untrusted sources, disable automatic image download/preview in messaging and email clients to prevent unattended decoding, and restrict installation of apps that render remote images - with the trade-off that disabling auto-preview degrades normal messaging usability. Enterprise fleets should push the update via MDM as soon as the carrier/OEM build is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libimagecodec.quram.so is the closed-source Quram image codec bundled across Samsung's Android firmware and used for decoding and rendering image formats including JPEG (and historically Qmage). Image parsers of this type are a recurring RCE surface on mobile platforms because they process untrusted, attacker-supplied files often without user interaction (e.g., thumbnail generation, messaging previews). Although the CWE is marked N/A in the input, the description specifies a heap-based buffer overflow, which corresponds to CWE-122: writing past the bounds of a heap-allocated buffer while parsing malformed JPEG structures, enabling memory corruption that can be steered toward code execution.
Know when Samsung Mobile Devices gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, no-interaction JPEG parsing with full CIA impact; AC:H reflects the CVSS 4.0 AT:P heap-grooming requirement for reliable code execution.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
DescriptionCVE.org
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
Executive ViewAI
Samsung mobile devices running firmware prior to SMR Sep-2026-1 contain a critical remote code execution vulnerability in the Quram image codec that enables arbitrary code execution through malicious JPEG files. This vulnerability affects millions of Samsung devices worldwide with no vendor-released patch identified at time of analysis, creating severe risk for unauthorized access, data compromise, and persistent device compromise across the installed base.
No vendor-released patch identified at time of analysis. Until Samsung releases SMR Sep-2026-1 or later firmware, disable automatic image preview and loading in email, messaging, and web browsers; restrict users from opening image files from unverified external sources; implement email gateway controls to block suspicious image attachments when feasible; consider deploying mobile threat defense solutions with behavioral detection capabilities; monitor for exploitation indicators such as unexpected process crashes, application hangs, or unusual system activity following image viewing; and maintain regular backups of critical data on affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with li
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Exploit-DB