============================================================================================================================================= | # Title : Android 13 Quram DNG Codec Memory Corruption Vulnerability | | # Author : indoushka | | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) | | # Vendor : https://www.samsung.com/n_africa/ | ============================================================================================================================================= [+] References : https://packetstorm.news/files/id/211371/ & CVE-2025-21055 https://packetstorm.news/download/211371 [+] Summary : CVE‑2025‑21055 is an Out‑of‑Bounds Read/Write vulnerability in **Samsung’s Quram image codec library** (`libimagecodec.quram.so`). The flaw is triggered when the library processes a maliciously crafted image file, causing memory access outside the intended buffer boundaries. Successful exploitation can result in **information disclosure**, **application crash**, or potentially **arbitrary code execution**, depending on the attack scenario. The issue affects Samsung devices running vulnerable versions of the Quram codec **prior to the security update SMR October 2025 Release 1**. Samsung addressed the vulnerability by releasing a patched version of the image codec library in the October 2025 Security Maintenance Release (SMR). [+] Vulnerability: Remote Code Execution in Samsung’s libimagecodec.quram.so library. [+] Affected software: Samsung devices running Android 13 with firmware older than SMR Oct‑2025 Release 1. [+] Impact: An attacker can exploit the vulnerability via specially crafted image files to execute arbitrary code on the device. [+] Affected devices: All Samsung devices using the vulnerable library version, including (but not limited to) Galaxy S22, S23, S24, Z Fold4, Z Flip4—only if firmware is unpatched. [+] Patch/Remediation: Apply the October 2025 SMR or later security update. [+] POC : python poc.py #!/usr/bin/env python3 """ Proof of Concept for CVE-2025-21055 Quram DNG Codec Memory Corruption Vulnerability """ import struct import os def create_malicious_dng(): """ إنشاء ملف DNG مصمم لإثارة الخلل في QuramDngOpcodeScalePerColumn """ # هيكل أساسي لملف DNG مع opcodes مخصصة dng_data = bytearray() # TIFF Header (مطلوب لملفات DNG) dng_data.extend(b'II*\x00') # Little-endian TIFF dng_data.extend(struct.pack('

Query Builder