Samsung HEIF Decoder CVE-2026-21125

Exploitation requires the device to process an attacker-controlled HEIF image through Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) on a device running firmware prior to SMR Oct-2026 Release 1; the specific 'sheifd' parsing path must be reached. The local attack vector (AV:L) is the key limiting factor: the malicious media must be delivered to the decoder from an on-device context (e.g., a malicious or compromised app) rather than purely over the network, even though no privileges (PR:N) or user interaction (UI:N) are stated. Patched firmware (Oct-2026 SMR) eliminates the condition.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 8.6) describes a local-vector, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality, integrity and availability impact to the vulnerable system - consistent with a memory-corruption bug in Samsung's HEIF image decoder (libsimba.heifdec.media.samsung.so). No EPSS score, KEV listing, or POC was provided, so there is no public evidence of active or imminent exploitation; this is currently a high-severity-by-metrics issue rather than a demonstrated real-world priority. Note a tension typical of media-codec bugs: the vector is AV:L with UI:N and PR:N, implying the malicious HEIF content must already be present/processed locally (e.g., delivered by a malicious or compromised app) rather than exploited fully remotely - the 'potentially execute arbitrary code' wording in the description also signals the vendor has not confirmed reliable code execution. The absence of EPSS/KEV/POC data is a data gap, not evidence of safety; absence should be verified against Samsung's October 2026 SMR bulletin.

A malicious or compromised application on a Samsung device supplies a specially crafted HEIF image to the system HEIF decoder, triggering improper input validation during 'sheifd' parsing and corrupting memory to run attacker-controlled code in the context of the decoding process. No public exploit code was identified at time of analysis, and because the vector is local, the attacker needs an existing foothold (such as an installed app) to deliver the crafted media.