_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
cve

CVE-2025-21042: Samsung Image Library Under Attack

Security Substrate

— 6 min read

CVE-2025-21042: Samsung Image Library Under Attack

CVE ID: CVE-2025-21042

Severity: HIGH | CVSS: 8.8

Sources: 2 different security sources

Status: ACTIVELY EXPLOITED - CISA KEV Listed

Let Me Explain What Happened

Let me walk you through something important that's happening right now with Samsung mobile devices. There's a vulnerability in how Samsung phones process certain types of images, and attackers are actively using it in the wild. When I say "actively exploited," I mean real attacks are happening as we speak—this isn't theoretical anymore. CISA (the Cybersecurity and Infrastructure Security Agency) has added this to their Known Exploited Vulnerabilities catalog, which is their way of saying "this is serious, and you need to act now."

Here's what makes this particularly concerning: attackers can send you a specially crafted image file, and when your Samsung device tries to process it, they can take complete control of your phone. Think of it like receiving a letter that, when you open it, gives a stranger the keys to your house. The vulnerability exists in a component called libimagecodec.quram.so—essentially the part of Samsung's software that handles image processing.

A Bit More Detail

The vulnerability is what we call an "out-of-bounds write." Imagine you have a notebook with 100 pages, and someone tricks you into writing on page 101—except there is no page 101, so you end up writing on your desk instead. In computer terms, the image processing library writes data outside the memory space it's supposed to use, and attackers exploit this to inject their own malicious code. What's particularly troubling is that researchers at Palo Alto Networks' Unit 42 team discovered this vulnerability being used to deliver commercial-grade spyware called LANDFALL, embedded in malicious DNG (Digital Negative) image files.

This isn't some amateur operation. Commercial-grade spyware means we're likely looking at sophisticated threat actors—possibly nation-state groups or well-funded criminal organizations—who have the resources to develop or purchase these kinds of exploits. The fact that it was delivered through DNG files is clever: these are legitimate image formats used by photographers, so they don't immediately raise suspicion.

The Technical Specifics

  • Attack Vector: Network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • What That Means: Attackers can exploit this remotely over a network, with low complexity, requiring no special privileges—but they do need you to interact with the malicious file (like opening an image)
  • Affected Products: Samsung Mobile Devices running software prior to SMR April 2025 Release 1
  • Affected Component: libimagecodec.quram.so (Samsung's image codec library)
  • CWE Classification: CWE-787 (Out-of-bounds Write)
  • Impact: Complete compromise—attackers can achieve high confidentiality impact (steal your data), high integrity impact (modify your data), and high availability impact (crash or control your device)
  • Known Exploitation: LANDFALL spyware campaign using malicious DNG image files
  • User Interaction Required: Yes—you need to open or process the malicious image file

Understanding the Attack Chain

Let me break down how this attack actually works, step by step, so you understand what you're protecting against:

  1. Delivery: The attacker sends you a malicious DNG image file. This could come through email, messaging apps, social media, or even be hosted on a compromised website.
  2. Trigger: When you open the image or when an app tries to generate a thumbnail preview, Samsung's image processing library (libimagecodec.quram.so) attempts to decode the file.
  3. Exploitation: The malicious DNG file contains specially crafted data that causes the library to write beyond its allocated memory boundaries.
  4. Code Execution: By carefully controlling what gets written where, attackers can inject and execute their own code—in this case, the LANDFALL spyware.
  5. Persistence: Once the spyware is running, it can establish persistence on your device, steal data, monitor communications, and potentially download additional malicious components.

Who's Behind the Attacks

While we don't have definitive attribution yet, the sophistication level tells us a lot. Unit 42 researchers characterized LANDFALL as "commercial-grade" spyware, which typically means one of two scenarios: either a nation-state actor developed it internally, or someone purchased it from the growing marketplace of commercial surveillance vendors. These vendors—sometimes called "lawful intercept" companies—sell sophisticated spyware to governments and law enforcement agencies, though their tools often end up being misused.

The use of DNG files specifically is interesting. It suggests the attackers did their homework and understood that security-conscious users might be wary of executable files or documents with macros, but would think twice before suspecting a photographer's raw image format. This level of operational security awareness points to experienced threat actors.

What You Should Do About This

Here's my guidance, prioritized by urgency:

  • Right Now (Emergency Actions):
    • Check your Samsung device's security patch level: Go to Settings → About phone → Software information. Look for the "Security patch level." If it shows anything earlier than April 2025, you're vulnerable.
    • Be extremely cautious with image files: Until you can patch, avoid opening image files from untrusted sources, especially DNG files. Yes, this is inconvenient, but remember—attackers are actively using this vulnerability right now.
    • Disable automatic image previews: In your messaging apps and email clients, turn off automatic image loading and thumbnail generation where possible. This reduces the attack surface since the vulnerability can be triggered just by generating a preview.
    • For Federal Agencies and Critical Infrastructure: CISA has issued specific guidance under BOD 22-01. If you fall under this directive, you must apply mitigations per vendor instructions or discontinue use of affected devices immediately.
  • Within 24-48 Hours (Patching):
    • Update to SMR April 2025 Release 1 or later: Go to Settings → Software update → Download and install. Samsung has released patches that fix this vulnerability. Make sure you're connected to Wi-Fi and have adequate battery life before starting.
    • Verify the patch installed correctly: After updating, check your security patch level again to confirm it shows April 2025 or later.
    • For enterprise environments: If you manage Samsung devices through an MDM (Mobile Device Management) solution, push the April 2025 security update to all managed devices as a high-priority deployment.
  • For the Long Term (Defense in Depth):
    • Enable automatic security updates: Go to Settings → Software update → Auto download over Wi-Fi. This ensures you get future security patches promptly.
    • Implement mobile threat defense: For enterprise environments, consider deploying mobile threat defense (MTD) solutions that can detect and block exploitation attempts.
    • User awareness training: Educate users about the risks of opening unexpected image files, even from seemingly trusted sources (accounts can be compromised).
    • Network monitoring: If you have the capability, monitor for unusual outbound connections from mobile devices that might indicate successful compromise and data exfiltration.

How to Detect If You've Been Compromised

If you're concerned your device might already be infected with LANDFALL or similar spyware, here are some indicators to look for:

  • Unusual battery drain: Spyware running in the background consumes power. If your battery life has suddenly decreased without explanation, investigate further.
  • Unexpected data usage: Spyware exfiltrating data will generate network traffic. Check your data usage statistics for apps that shouldn't be using much data.
  • Device performance issues: Unexplained slowdowns, apps crashing more frequently, or the device heating up when idle can all be signs of malicious activity.
  • Strange behavior: Apps opening on their own, settings changing without your input, or new apps appearing that you didn't install.

If you observe these symptoms and suspect compromise, the safest course of action is to back up your personal data (photos, contacts—but not apps), perform a factory reset, and then apply all available security updates before restoring your data.

For Security Teams: Detection and Hunting

If you're responsible for security monitoring in an enterprise environment with Samsung mobile devices, here's what you should be looking for:

Network-Level Detection:

  • Monitor for DNG file transfers, especially from external sources or through messaging platforms
  • Look for unusual outbound connections from mobile devices to infrastructure that doesn't match your normal baseline
  • Watch for data exfiltration patterns—large uploads from mobile devices to unfamiliar destinations

Endpoint-Level Detection:

  • If you have mobile threat defense deployed, review alerts for suspicious application behavior or privilege escalation attempts
  • Check MDM logs for devices that haven't received the April 2025 security update
  • Review application installation logs for unexpected apps appearing on devices

MITRE ATT&CK Mapping:

  • Initial Access: T1566.001 (Phishing: Spearphishing Attachment) - malicious DNG files delivered via messaging
  • Execution: T1203 (Exploitation for Client Execution) - exploiting the image codec vulnerability
  • Persistence: Likely T1398 (Boot or Logon Initialization Scripts) or similar mobile persistence techniques
  • Collection: Various mobile collection techniques depending on LANDFALL's specific capabilities
  • Exfiltration: T1041 (Exfiltration Over C2 Channel) - data stolen through command and control infrastructure

Why This Matters More Broadly

Let me put this in a larger context for you. This vulnerability represents a concerning trend we're seeing in mobile security: sophisticated attackers are increasingly targeting mobile devices because that's where sensitive data lives today. Your phone has your emails, your messages, your location history, your photos, your banking apps—it's a treasure trove of information.

The fact that CISA added this to their KEV catalog so quickly after the patch was released tells us they have intelligence suggesting active, widespread exploitation. They don't add vulnerabilities to that list lightly—it's reserved for vulnerabilities that pose significant risk to federal enterprises and critical infrastructure.

For those of you in security roles, this is also a good reminder about the importance of mobile device management and mobile security in your overall security program. If you've been treating mobile devices as less critical than laptops and servers, it's time to reconsider that approach.

Where I Found This Information

Note: This analysis is based on information from multiple authoritative security sources as of November 2025. The situation is actively evolving as this vulnerability is being exploited in the wild. Always verify patch compatibility with your specific device model before applying updates, and consult your organization's change management procedures for enterprise deployments. If you're a federal agency or critical infrastructure operator, follow the specific guidance provided by CISA under BOD 22-01.

Read more