Overview

• Samsung’s September 2025 Security Maintenance Release patches CVE-2025-21043, which the company says has an exploit observed in the wild.
• The bug is an out‑of‑bounds write in libimagecodec.quram.so from Quramsoft, enabling remote code execution via crafted images and rated critical (CVSS ~8.8).
• The fix is rolling out in stages to eligible Galaxy devices on Android 13 through 16, so users should install the update and reboot as soon as it appears.
• Meta’s WhatsApp security team reported the issue on Aug. 13 and provided mitigations, though it remains unclear whether other messaging apps using the library are affected.
• Recent coverage notes related zero‑click targeting on iOS and highlights broader update dynamics, including Google’s shift toward critical‑only monthly patches and Samsung’s One UI 8 rollout requiring the September fix.