CVE-2026-21095
A heap-based buffer overflow exists in the DNG decoder of libimagecodec.quram.so. The flaw allows attackers to run arbitrary code on affected systems. It is fixed in SMR Sep‑2026 Release 1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Any software that includes libimagecodec.quram.so before SMR Sep‑2026 Release 1, such as image processing applications that use the DNG decoder.
Real-world impact
An attacker who can send a specially crafted DNG file to the vulnerable program can cause the program to execute code of the attacker’s choice, potentially taking full control of the system.
Why this severity
The CVSS score of 9.2 reflects that the vulnerability can be exploited remotely without authentication, has a high impact on confidentiality, integrity, and availability, and allows arbitrary code execution.
What to do about it
- 01Upgrade libimagecodec.quram.so to SMR Sep‑2026 Release 1 or later.
- 02Restart any services or applications that use the library to ensure the new version is loaded.
NVD description
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Sep 11, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- security.samsungmobile.com/securityUpdate.smsbvendor advisory