High severity · published Jul 10, 2026
CVE-2026-21045
Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Samsung Mobile Devices · Samsung Mobile
All versions, or not specified · source: vendor
In the news
VulnerabilityHigh
ZDI-26-529: Samsung Galaxy S25 TIFF File Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S25 devices. User interaction may be required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-21045.
Aug 11, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21045
security.samsungmobile.com
https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07
More from Samsung Mobile Devices
9.8
CVE-2025-21043
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
9.8
CVE-2025-21042
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
7.8
CVE-2022-22265
Samsung Mobile Devices Use-After-Free Vulnerability
7.8
CVE-2021-25487
Samsung Mobile Devices Out-of-Bounds Read Vulnerability
7.1
CVE-2021-25337
Samsung Mobile Devices Improper Access Control Vulnerability