Overview

• The critical bug CVE-2025-21043 is an out-of-bounds write in the closed-source libimagecodec.quram.so that allows remote code execution, and Samsung confirms an exploit existed in the wild.
• Samsung has added the fix to its September 2025 Security Maintenance Release for devices running Android 13 through 16, with availability varying by model, region and carrier.
• WhatsApp and Meta privately notified Samsung on August 13 following a targeted exploit investigation, and both WhatsApp and Samsung have released patches.
• Security researchers note the vulnerable image parser is used by apps that process images on Samsung devices, and it is still unclear whether services beyond WhatsApp were impacted.
• National cyber authorities including Singapore’s CSA, along with security firms, are urging users to check for and install the September update immediately as the scope of exploitation is assessed.