CVE-2026-20973 is a medium severity out-of-bounds read (CVSS 5.3) in libimagecodec.quram.so on Samsung Android devices. A remote attacker could read memory they should not. Samsung fixed it in the SMR Jan-2026 Release 1 security update, so install that update or a later one.
What's affected
The record says the issue exists in libimagecodec.quram.so before SMR Jan-2026 Release 1. That is Samsung's image codec library, and SMR is Samsung's Security Maintenance Release. The weakness is CWE-125 (out of bounds read). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, so the scored impact is a limited loss of confidentiality only.
Any Samsung device with a security patch level older than January 2026 is affected. Samsung publishes its monthly bulletins on its mobile security site, and I did not find the CVE text on the page I could load, so check the January 2026 bulletin for the list of devices. The record does not mark this as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and read the Android security patch level. If it is earlier than 1 January 2026, the device is affected.
For managed devices, your mobile device management tool should report the patch level per device. Filter for devices with a level older than the one you have set as your baseline.
What to do now
- Open Settings, then Software update, and install the latest update on every Samsung device.
- Check the patch level afterwards and confirm that it is January 2026 or later. Later monthly patches should include this fix too.
- For managed fleets, set a minimum patch level in your device management policy and report on devices below it.
- Retire or isolate devices that no longer receive updates.
- Keep automatic updates on.
Why it matters
An out of bounds read means a program reads past the end of a buffer. It does not change anything, but it can reveal data that sits next to it in memory, such as parts of other images or internal state. These reads sometimes help an attacker defeat protections for a second bug, so they are worth fixing even at a medium score.
Image codecs are a frequent source of memory bugs because they parse complex formats from untrusted sources, and a shared library can serve more than one app. A fix in the library reaches every app that uses it, which is the benefit of a monthly platform update.
Quick check
Do I need to do anything besides updating?
No separate step is described. Install the January 2026 update or later, and check the patch level to confirm.
Sources
Last reviewed: 19 October 2026.
