CVE-2026-21102 – Samsung Mobile Devices
“One poisoned image is all it takes to turn a trusted phone into an attacker's foothold.”
Samsung's SMR Sep-2026 Release 1 fixes three Critical vulnerabilities in Samsung Mobile Devices. Two are heap-based buffer overflows in the libimagecodec.quram.so image library. CVE-2026-21095 sits in the DNG decoder and has a CVSS score of 9.2, Critical severity. CVE-2026-21096 sits in the JPEG decoder and has a CVSS score of 9.2, Critical severity. Both let remote attackers execute arbitrary code by delivering a crafted image to the device.
The third flaw, CVE-2026-21102, is a use-after-free in DualDAR with a CVSS score of 9.3, Critical severity. It lets local privileged attackers execute arbitrary code with root privileges, giving them full control of the device and the corporate data it holds. Devices that are not on SMR Sep-2026 Release 1 remain exposed to all three flaws.
Key Details
- Affected Product
- Samsung Android
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-416