CVE-2026-21096 is a critical heap based buffer overflow (CVSS 9.8) in the JPEG decoder of libimagecodec.quram.so on Samsung Android devices. Remote attackers could execute arbitrary code. Samsung fixed it in SMR Sep-2026 Release 1, so install that security update or a later one.
What's affected
The record names the JPEG decoder of libimagecodec.quram.so before SMR Sep-2026 Release 1. The weakness is CWE-122 (heap based buffer overflow). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-21095 is the companion record for the DNG decoder in the same library, with the same fix. JPEG is the most common image format on a phone, which makes this decoder one of the most used parts of the library. The record does not mark either as exploited in the wild, and neither is in the CISA Known Exploited Vulnerabilities catalog. The September 2026 bulletin page loaded but did not show the CVE text, so check it for affected models.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and check the Android security patch level. A level before 1 September 2026 means the device is affected.
For a fleet, ask your device management tool for the patch level of each device and filter for older ones.
What to do now
- Install the latest Samsung software update on every device and confirm a September 2026 or later patch level.
- Enforce a minimum patch level through device management and chase any device below it.
- Replace devices that no longer get monthly updates.
- Keep automatic updates on for personal devices used for work.
- Fix CVE-2026-21095 at the same time, since the same update covers it.
Why it matters
The cause is the same class as its sibling: a heap buffer overflow when the decoder processes an image. JPEG decoders are old, widely used and heavily tested, yet they still turn up memory bugs because the format has many optional parts and a decoder has to handle every malformed variant without trusting the lengths it reads.
Memory safe languages remove much of this class of bug, but the codec is native code that is used everywhere on the device. Until that changes, the monthly patch is the defence. Fleet owners should measure how long it takes for a patch to reach every device.
Quick check
Why is this scored 9.8 when the user must receive an image?
The vector says no user interaction is needed (UI:N), so the score assumes the image can be processed without the user opening it. Real conditions vary, and the patch removes the question.
Sources
Last reviewed: 19 October 2026.
