important · Zero-click
Samsung says crafted DNG or JPEG data can execute code in a Galaxy image-decoder process.
Affects
Samsung Galaxy mobile devices using Samsung's libimagecodec.quram.so image-decoding library on Android.
The underlying heap overflows affect libimagecodec.quram.so on Android 14 through 17, with Samsung's fix in September Release 1.
Detail and 1 source
We do not know which default application reaches the decoder or whether receipt alone triggers it.
Chain to watch
Deliver a crafted DNG or JPEG through a default application→↓Determine whether receipt or preview invokes libimagecodec.quram.so→↓Map decoder execution into its UID and sandbox→↓The delivery application, automatic invocation path, UID, and sandbox remain unidentified.
Unverified chainTrace the decoder while delivering files through Samsung Messages, RCS/MMS, email, Quick Share, cloud synchronization, and gallery indexing.