Samsung’s September 2025 security updates for Android devices include a patch for a vulnerability that has been exploited in the wild.
The exploited bug, tracked as CVE-2025-21043 (CVSS score of 8.8), is described as an out-of-bounds write issue in the libimagecodec.quram.so image parsing library, which is used by applications that process images on Samsung devices.
According to Samsung, successful exploitation of the security defect allows remote attackers to execute arbitrary code on vulnerable devices.
“Samsung was notified that an exploit for this issue has existed in the wild,” the mobile phone maker notes in its advisory.
The company has not shared details on the flaw, nor on the observed exploitation, but credited the Meta and WhatsApp security teams for reporting it on August 13.
The timing of the report and the fact that the Samsung zero-day was in a core image library suggests that CVE-2025-21043 might have been exploited in attacks targeting WhatsApp users, just as was CVE-2025-43300, an out-of-bounds write issue in the ImageIO framework component of iOS, iPadOS, and macOS.
The Apple bug, WhatsApp said two weeks ago, was likely chained with a WhatsApp vulnerability tracked as CVE-2025-55177 in “a sophisticated attack against specific targeted users”.
The Meta-owned communication platform said at the time it had notified less than 200 users of potential attacks targeting their devices.
WhatsApp’s late August advisory made no mention of CVE-2025-55177 being exploited against Android users, although Amnesty International’s Donncha Ó Cearbhaill said that both iPhone and Android users were impacted. The attacks were attributed to spyware vendors.
“Early indications are that the WhatsApp attack is impacting both iPhone and Android users, civil society individuals among them. Government spyware continues to pose a threat to journalists and human rights defenders,” Ó Cearbhaill said.
SecurityWeek has emailed both Samsung and WhatsApp for clarification and will update this article if the two companies respond.
Related: Hackers Exploit Sitecore Zero-Day for Malware Delivery
Related: Two Exploited Vulnerabilities Patched in Android
Related: Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers
Related: Citrix Patches Exploited NetScaler Zero-Day
Source link
