Samsung had three separate vulnerabilities confirmed exploited over the past year, split across two entirely different product categories: an enterprise digital-signage server and the image-decoding library shipped on its mobile devices, the latter hit twice within a five-month patch window and tied to a commercial-grade Android spyware campaign.
| CVE | CVSS | Product | Added to KEV |
|---|---|---|---|
| CVE-2024-7399 | 8.8 | MagicINFO 9 Server | 24 Apr 2026 |
| CVE-2025-21042 | 8.8 | Mobile Devices (libimagecodec.quram.so) | 10 Nov 2025 |
| CVE-2025-21043 | 8.8 | Mobile Devices (libimagecodec.quram.so) | 2 Oct 2025 |
Why the same library breaking twice in five months isn't a coincidence
CVE-2025-21043 and CVE-2025-21042 are both out-of-bounds write vulnerabilities in the exact same component, libimagecodec.quram.so, Samsung's third-party image-decoding library. One was fixed in the September 2025 Security Maintenance Release, the other in the April 2025 release — meaning the two flaws were patched roughly five months apart, yet both ended up confirmed exploited and both were added to CISA's KEV catalogue within about five weeks of each other in late 2025. A single third-party codec library producing two independent memory-corruption bugs, both weaponized, describes a component that attackers have clearly identified as a productive place to keep looking, and a library Samsung's own review process evidently didn't manage to fully harden between the two patch cycles.
Image codec libraries are an especially attractive target because they process attacker-controlled input — a photo, a thumbnail, an MMS attachment — with no user action beyond receiving or viewing a file, and often no explicit user interaction at all if the rendering happens automatically for a preview or notification. That combination of automatic invocation and untrusted input is precisely the profile that produces zero-click or one-click exploitation chains, which is exactly what researchers found here: Palo Alto Networks' Unit 42 tied CVE-2025-21042 to "Landfall," a commercial-grade Android spyware operation, meaning this out-of-bounds write wasn't an isolated proof-of-concept but an operational component of a surveillance tool actively deployed against real targets.
Why MagicINFO belongs in the same conversation despite being a completely different product
CVE-2024-7399 affects MagicINFO 9 Server, Samsung's digital signage management platform used to push content to fleets of commercial displays — a world away from a phone's camera roll. But the underlying failure mode rhymes: a path traversal vulnerability lets an attacker write arbitrary files with system authority, the same category of "attacker-controlled input reaches a filesystem operation without adequate validation" that shows up constantly across this series regardless of vendor. Arctic Wolf researchers documented active exploitation of this flaw, meaning it wasn't a theoretical disclosure — it was chained by real intruders against internet-facing MagicINFO deployments to plant files and establish footholds with the server's own elevated permissions.
The practical lesson from grouping these three together is that "Samsung" as a vendor spans an unusually wide range of deployment contexts — from a signage server sitting in a data center to a codec library running on hundreds of millions of individual handsets — and a vulnerability management program that only tracks one product family risks missing exploitation activity happening in the other.
What to check this week
- Confirm mobile fleet devices are current on the April 2025 and September 2025 Samsung Security Maintenance Release baselines, not just "reasonably recent" — the five-month gap between these two fixes means a device patched only through the spring release remains exposed to the second bug.
- Inventory any MagicINFO 9 Server deployments and verify the version is 21.1050 or later, treating internet-facing signage management servers with the same urgency as any other externally reachable administrative system.
- Review MagicINFO server logs for anomalous file writes outside expected content directories, given that Arctic Wolf's research describes active exploitation already using this exact path traversal technique.
- Treat Landfall-style spyware detection as a mobile threat model item, not just a consumer privacy concern, for any organization issuing Samsung devices to executives, journalists, or other high-value targets.
A closing note on library-level risk hiding inside vendor patch notes
When two CVEs in the same underlying library surface five months apart, it's tempting to read the second as "already handled" simply because the vendor previously patched something nearby. The KEV catalogue's treatment of these as two fully distinct entries, both independently confirmed exploited, is a useful corrective — a library that has already produced one exploited memory-safety bug deserves ongoing scrutiny of its subsequent patches specifically, not passive trust that the vendor closed the door on similar issues the first time around.
How Safeguard helps
Safeguard's continuous inventory tracks vulnerability history at the component level, not just the top-line product name, so a shared library like libimagecodec.quram.so producing repeat confirmed-exploited findings across different CVE numbers gets surfaced as a pattern worth elevated attention rather than getting lost as two unrelated line items in a spreadsheet.
