Quram DNG Decoder Heap Overflow (libimagecodec.quram.so)

Technical Analysis

CVE-2026-21095 is a heap-based buffer overflow in the DNG (Digital Negative) image parsing routine of libimagecodec.quram.so, a closed-source native codec library bundled in Samsung's Android firmware for handling image formats. Insufficient bounds checking during DNG decoding allows a specially crafted image to overwrite heap memory, potentially corrupting adjacent structures and enabling arbitrary code execution in the context of the process parsing the image (commonly system-level media/gallery services with elevated privileges). Given the CVSS 9.8 rating, the attack vector likely requires no privileges and minimal user interaction, consistent with zero-click or one-click exploitation via messaging apps, cloud photo sync, or malicious file attachments. Exploitation of this class of bug typically follows a pattern of heap grooming to achieve predictable memory layout followed by ROP/JOP chaining to bypass ASLR/DEP mitigations. Devices running AI agent or assistant applications that ingest, process, or auto-analyze images (e.g., on-device multimodal AI features, photo-based agent tooling, or camera-integrated LLM apps) on affected Samsung hardware could have their host compromised, exposing any locally stored agent credentials, API keys, or session tokens to the attacker.

Affected Systems

Samsung Android devices running libimagecodec.quram.so versions prior to the September 2026 Samsung Mobile Security Release (SMR Sep-2026 Release 1); affects devices processing DNG image files through the Quram image codec library used in Samsung's Android firmware stack.

Indicators of Compromise

• No specific IOCs published (vulnerability disclosure; no confirmed active exploitation samples, hashes, or C2 infrastructure identified at time of analysis).

Remediation Steps

1. 1

   Apply Samsung Security Patch

   Update all affected Samsung devices to SMR Sep-2026 Release 1 or later immediately through Software Update or enterprise MDM push.

2. 2

   Restrict Untrusted Image Sources

   Block or filter unsolicited image/DNG file attachments from unknown senders via MMS, messaging apps, and email gateways until patches are deployed fleet-wide.

3. 3

   Enterprise Mobile Device Management Enforcement

   Use MDM/EMM policies to enforce mandatory OS update compliance and quarantine non-compliant devices from corporate networks and services.

4. 4

   Monitor for Exploitation Indicators

   Watch for anomalous crashes in media/gallery/imagecodec processes, unexpected app respawns, or unusual outbound connections following image receipt on unpatched devices.

5. 5

   Audit On-Device Agent Credentials

   For devices running AI assistant or agent applications with stored API keys/tokens, rotate credentials and review access logs if devices remain unpatched or show signs of compromise.