CVE-2025-21043 is an out-of-bounds write vulnerability in Samsung Android devices' image codec library that requires user interaction for exploitation. While actively exploited as a zero-day, it affects client devices rather than internet-facing servers.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: USER_INTERACTION
CVE Published: 2025-09-12
Added to CISA KEV: 2025-10-02 20 DAYS BETWEEN CVE AND KEV
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. Metrics. CVSS ...
CVE-2025-21043 - Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
The timing of the report and the fact that the Samsung zero-day was in a core image library suggests that CVE-2025-21043 might have been exploited in attacks targeting WhatsApp users, just as was CVE-2025-43300, an out-of-bounds write issue in the ImageIO framework component of iOS, iPadOS, and macOS.
Samsung patched CVE-2025-21043 on Sep 2025 after zero-day Android exploits enabled code execution.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior ...