Samsung image library flaw used to deliver LANDFALL spyware

**CVE-2025-21042** is a **Samsung image processing library** flaw that was **exploited as a zero-day** to deliver **LANDFALL** spyware and achieve **remote code execution** on affected **Samsung Galaxy** devices before Samsung’s **April** patch. The exploitation path involved a **specially crafted DNG image** delivered through **WhatsApp**, and CISA later cited the campaign as part of a broader wave of attacks against **mobile messaging apps** and high-value users. The same vulnerability thread is now also linked to a **Samsung** campaign targeting **Galaxy devices in the Middle East**.

A **LandFall** spyware campaign has used **malicious DNG image files** over **WhatsApp** to target **Samsung devices** in the **Middle East**, raising covert surveillance risk. The operation has been active since **mid-2024** and may have relied on **zero-click exploits** to trigger **remote code execution**. It is designed for **microphone recording**, **location tracking**, and harvesting **photos, contacts, and call logs**. The tradecraft points to a persistent commercial spyware effort rather than a one-off lure.

The **LandFall** spyware operation used malicious **.DNG** images sent over **WhatsApp** to exploit Samsung’s **CVE-2025-21042**, execute code on targeted Galaxy phones, and keep access for spying. The activity affected select **Samsung Galaxy** users in the **Middle East** and supported **persistence**, **microphone recording**, and **call recording**. Samples seen as early as **July 23, 2024** show the operation had been active before the patch. Affected models included **Galaxy S22/S23/S24** and **Z Fold 4/Z Flip 4**.

**CISA** added **CVE-2025-21042** to the **KEV catalog**, triggering a formal federal response to a **Samsung** zero-day that had been reported as actively abused in spyware operations. The directive orders **US federal agencies** to apply vendor mitigations, follow **BOD 22-01** cloud guidance, or discontinue use if mitigations are unavailable. Agencies must comply by **December 1**, and the flaw is an **out-of-bounds write** bug with a **9.8 CVSS** score that Samsung patched in **April**.

**Samsung** released **SMR Sep-2025 Release 1** to fix **CVE-2025-21043**, a **critical remote code execution** flaw in **libimagecodec.quram.so** on **Android 13+** devices. Samsung said the bug is an **out-of-bounds write** and that an exploit had existed **in the wild**. The patch matters because unupdated devices could be remotely compromised through malicious image content.