important · Mobile — Samsung
Two Samsung image decoders allow remotely supplied DNG or JPEG data to execute code.
Affects
Samsung Galaxy mobile devices on Android 14–17 that use Samsung's libimagecodec.quram.so image decoder.
The DNG and JPEG paths in libimagecodec.quram.so contain heap overflows that Samsung says can produce remote arbitrary-code execution.
Detail and 1 source
We do not know the cheapest delivery route, whether the victim must interact, or the identity and sandbox of the decoder process.
Samsung’s September bulletin lists fixed software for both flaws.