CVE-2025-58478: Samsung Android Memory Vulnerability

CVE-2025-58478 Overview

CVE-2025-58478 is an out-of-bounds write vulnerability in libimagecodec.quram.so, a Samsung image codec library shipped with Samsung Android devices. The flaw affects Samsung Android versions 13, 14, 15, and 16 prior to the SMR Dec-2025 Release 1 security maintenance update. Remote attackers can trigger the condition over the network without authentication or user interaction, reaching out-of-bounds memory during image processing. The weakness is classified as [CWE-787] Out-of-bounds Write. Samsung addressed the issue in its December 2025 security maintenance release.

Critical Impact
A remote attacker can deliver a crafted image to a vulnerable Samsung Android device and cause libimagecodec.quram.so to write outside an allocated buffer, exposing the device to memory corruption and potential confidentiality impact.

Affected Products

Samsung Android 13.0 prior to SMR Dec-2025 Release 1
Samsung Android 14.0 prior to SMR Dec-2025 Release 1
Samsung Android 15.0 and 16.0 prior to SMR Dec-2025 Release 1

Discovery Timeline

2025-12-02 - CVE-2025-58478 published to NVD
2025-12-05 - Last updated in NVD database
December 2025 - Samsung releases SMR Dec-2025 Release 1 security patch

Technical Details for CVE-2025-58478

Vulnerability Analysis

The vulnerability resides in libimagecodec.quram.so, a native image decoding library developed by Quramsoft and used by Samsung Android to parse image formats across system and application surfaces. During parsing of a malformed image, the codec writes data past the bounds of an allocated buffer. The CVSS vector indicates a network attack path with no authentication and no user interaction, suggesting reachable parsing logic from remote sources such as messaging attachments, browser-rendered content, or media previews.

While the published impact subscores limit the documented effect to confidentiality, out-of-bounds writes in native image codecs are a recurring path to memory corruption on Android. Samsung's advisory aggregates this issue into the December 2025 SMR bundle without releasing exploitation details.

Root Cause

The root cause is missing or insufficient bounds checking inside an image parsing routine in libimagecodec.quram.so. When the codec processes attacker-controlled image dimensions, offsets, or chunk lengths, the resulting write operation extends beyond the buffer allocated to hold decoded pixel or metadata data, satisfying the conditions of [CWE-787].

Attack Vector

Exploitation requires delivering a crafted image file to a code path that invokes libimagecodec.quram.so. Typical remote delivery channels on Samsung Android include MMS, RCS, instant messaging clients, email attachments, web pages, and thumbnail generation triggered by file synchronization. No verified public proof-of-concept is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is publicly available. Refer to the Samsung Security Update December 2025 advisory for vendor-provided details.

Detection Methods for CVE-2025-58478

Indicators of Compromise

Unexpected crashes or tombstones referencing libimagecodec.quram.so in /data/tombstones/ or logcat output on Samsung devices.
Repeated delivery of malformed image attachments through MMS, RCS, or messaging applications to the same device or user population.
Native-layer signal handlers reporting SIGSEGV or SIGABRT within image parsing call stacks on unpatched Samsung Android builds.

Detection Strategies

Inventory Samsung Android devices and flag any running a build older than SMR Dec-2025 Release 1 using mobile device management (MDM) telemetry.
Monitor mobile threat defense and EDR feeds for native crashes in libimagecodec.quram.so correlated with inbound image delivery.
Alert on anomalously large or malformed image files arriving through messaging and email gateways destined for Samsung endpoints.

Monitoring Recommendations

Forward device crash reports and mobile telemetry to a centralized analytics platform to correlate codec crashes with sender and URL reputation.
Track patch-level compliance across the Samsung Android fleet and surface devices that fall behind the December 2025 SMR baseline.
Review messaging gateway logs for repeated malformed image deliveries targeting specific users, which can indicate targeted exploitation attempts.

How to Mitigate CVE-2025-58478

Immediate Actions Required

Install the Samsung SMR Dec-2025 Release 1 update on all affected Samsung Android 13, 14, 15, and 16 devices as soon as the carrier release is available.
Enforce a minimum patch level policy in MDM so that non-compliant devices lose access to corporate resources until updated.
Advise high-risk users to disable automatic media download in messaging applications such as Messages, WhatsApp, and Signal until patches are applied.

Patch Information

Samsung addressed CVE-2025-58478 in the SMR Dec-2025 Release 1 security maintenance release. Full advisory details and device-specific patch availability are documented in the Samsung Security Update December 2025 bulletin. Patch rollout to end users depends on device model, region, and carrier certification.

Workarounds

Disable automatic image preview and auto-download for MMS, RCS, and third-party messaging clients on unpatched devices.
Restrict opening of unsolicited image attachments and links from unknown senders until the SMR Dec-2025 Release 1 patch is installed.
Where supported, use Samsung Knox or MDM policies to block sideloaded applications that may invoke vulnerable image parsing paths.

bash

# Verify Samsung Android security patch level via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
# Expected output should reflect the December 2025 (or later) security patch level