CVE WatchOct 8, 2026

CVE-2025-21043

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CVSS

8.8

High

EPSS

2.1%

p82

KEV

YES

Oct 2, 2025

Exploit Today

0-100

Published: Sep 12, 2025 · Last modified: Oct 8, 2026 · CWE-787

EPSS · 30d

1.9%EPSS · 30 days2.1%

2026-09-172026-10-15

KEV catalog record

Product

Samsung / Mobile Devices

Vulnerability

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Added to KEV

Oct 2, 2025

Remediate by

Oct 23, 2025

Known ransomware use

Summary description

Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21043

Technical description

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-111458—

—

———The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.6h CVE-2026-1113828.8 HIG

—

———FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.9h CVE-2026-890625.5 MED

—

———A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.12h CVE-2026-1112807.4 HIG

—

———snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.14h CVE-2026-1112756.1 MED

—

———nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.14h CVE-2026-1112706.1 MED

—

———libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.14h