{"id":"CVE-2025-21042","details":"Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.","modified":"2026-04-10T05:22:20.962686Z","published":"2025-09-12T08:15:44.743Z","references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21042"},{"type":"ADVISORY","url":"https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04"},{"type":"ADVISORY","url":"https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"13.0-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-apr\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-apr\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-apr\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-aug\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-aug\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-aug\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-dec\\-2021\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-dec\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-dec\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-dec\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-feb\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-feb\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-feb\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-feb\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jan\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jan\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jan\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jan\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jul\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jul\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jul\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jun\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jun\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-jun\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-mar\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-mar\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-mar\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-may\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-may\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-may\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-may\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-nov\\-2021\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-nov\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-nov\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-nov\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-oct\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-oct\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-oct\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-sep\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-sep\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"13.0-smr\\-sep\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-apr\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-apr\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-apr\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-aug\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-aug\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-aug\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-dec\\-2021\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-dec\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-dec\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-dec\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-feb\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-feb\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-feb\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-feb\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jan\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jan\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jan\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jan\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jul\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jul\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jul\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jun\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jun\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-jun\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-mar\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-mar\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-mar\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-mar\\-2025\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-may\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-may\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-may\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-nov\\-2021\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-nov\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-nov\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-nov\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-oct\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-oct\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-oct\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-sep\\-2022\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-sep\\-2023\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.0-smr\\-sep\\-2024\\-r1"}]},{"events":[{"introduced":"0"},{"last_affected":"15.0-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"15.0-smr\\-mar\\-2025\\-r1"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21042.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}