External risk intelligence

DNG Decoder Heap Buffer Overflow Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-21095

The vulnerability exists in a DNG image decoder library (libimagecodec.quram.so). While image processing libraries can be exposed to the internet when handling user-uploaded files or processing web content, they are not inherently public-facing services or gateways by design. Exposure depends heavily on the specific application's implementation and how it processes untrusted image data.

Buffer Overflow

Samsung Android

14.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DNG image decoder within libimagecodec.quram.so, potentially allowing remote attackers to execute arbitrary code. This issue exists in versions prior to the September 2026 security release.

Attackers could execute code remotely.
Understand its potential impact on systems.
Verify relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted DNG image file to a target system. If that system processes the image using the vulnerable DNG decoder within `libimagecodec.quram.so`, it could trigger a heap-based buffer overflow. This overflow might allow the attacker to execute arbitrary code on the affected system.

Requires a DNG image file.
Triggered by processing a malicious DNG.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow in the DNG decoder component could allow attackers to execute arbitrary code. This could occur when processing a specially crafted DNG image file.

Code execution
Processing crafted DNG files
Remote code execution

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the DNG decoder of libimagecodec.quram.so impacts Samsung's September 2026 Release 1. The primary responsibility for addressing this critical heap-based buffer overflow likely falls to the platform or application teams managing the image processing components, in coordination with vendor management if Samsung is a third-party supplier of this library. The first practical step is to confirm the presence of the affected component, assess its exposure and business criticality, and then plan remediation based on the identified risk.

Platform or application owners should investigate.
Verify affected component reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libimagecodec.quram.so?

This component is a software library designed for image processing. It specifically contains a DNG decoder, which is the code responsible for reading, interpreting, and rendering Digital Negative (DNG) image files. Such libraries are commonly integrated into operating systems or photography applications to handle raw image formats.

How does CVE-2026-21095 work?

This vulnerability is a heap-based buffer overflow. It occurs when the DNG decoder attempts to write more data into a reserved section of memory (the heap) than it can hold. Because the software fails to properly check the size of the incoming image data, the extra information can overwrite adjacent memory, potentially enabling an attacker to run their own unauthorized instructions.

Do I need to do anything to trigger this bug?

Yes, the vulnerability is not triggered automatically by simply having the software installed. An attacker must first deliver a specially crafted, malicious DNG image file to the target system. The flaw only manifests when the application or operating system actively processes or opens that specific malicious file.

Is my system at risk?

According to Halo Surface Signal, this depends on how your applications handle image data. While the vulnerability is classified as having a network attack vector, the library is not a public-facing service by design. Risk is higher if your software automatically processes untrusted DNG files from the internet; if the library is used only for local, trusted files, the exposure is significantly reduced.

How should I respond to this threat?

Your first step is to identify if your environment utilizes the vulnerable libimagecodec.quram.so library. Coordinate with your platform or application teams to determine where this component is deployed and whether it handles external input. Once mapped, prioritize updating to the SMR September 2026 Release 1 or later, which contains the necessary security fixes for this decoder.

References

security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.