In short: On September 8, 2026, Samsung released SMR-SEP-2026 for Galaxy devices — a patch covering 90 vulnerabilities. Two of them are critical: CVE-2026-21095 and CVE-2026-21096 (both CVSS 9.2), heap buffer overflows in Samsung's proprietary image-decoding library libimagecodec.quram.so. An attacker can execute arbitrary code by sending a victim a specially crafted DNG or JPEG file — no tap or confirmation required. Both flaws were found by Google Project Zero researchers.
How the attack works: a picture that runs code silently
Both vulnerabilities reside in Samsung's proprietary libimagecodec.quram.so library, used for image rendering across Galaxy devices. CVE-2026-21095 targets the DNG (Camera RAW) decoder; CVE-2026-21096 targets the JPEG decoder.
Both are heap-based buffer overflows: the library receives a malformed image file, allocates a buffer too small for the actual data, then writes image scanlines past the buffer boundary. This lets an attacker overwrite adjacent heap memory and redirect execution to attacker-controlled code.
The critical characteristic: attack vector UI:N — User Interaction: None. The victim does not need to tap a file, open it manually, or grant any permission. The device only needs to process the image — for example, during thumbnail generation in a messaging app or gallery preview. Send a crafted DNG or JPEG via WhatsApp or Telegram, and Galaxy executes attacker code automatically upon receipt of the file.
The flaws were discovered by Brendon Tiszka and Mateusz Jurczyk of Google Project Zero. Notably, the same libimagecodec.quram.so was exploited in 2025: the Landfall spyware used malformed DNG files delivered via WhatsApp to compromise devices (CVE-2025-21042, patched April 2025). Samsung is relying on the same third-party image library that Project Zero keeps finding issues in. For a running record of device-level threats, see the LiMP VPN news section.
Scope: who is affected by SMR-SEP-2026
The September update covers 90 vulnerabilities across three categories:
- 58 vulnerabilities from the Android Security Bulletin (Google): 18 critical, 40 high-severity
- 31 Samsung SVE (Samsung Vulnerability & Exposure) issues in One UI components
- 1 Samsung Semiconductor issue — Exynos processors (CVE-2026-48173, NAS message handler)
CVE-2026-21095 and CVE-2026-21096 are Samsung SVE items — they are not part of Google's standard Android Security Bulletin. Devices from other manufacturers (Pixel, Xiaomi, Oppo, etc.) are not affected by these specific flaws; they exist exclusively in the Samsung Galaxy software stack.
Vulnerable devices: Galaxy S23–S26 (all Ultra/Plus/FE variants); Galaxy Z Fold 4–8 and Flip 4–8; Galaxy Tab S8–S10; Galaxy A, M, and F series running Android 14–17 — the vast majority of Samsung's current device portfolio.
To verify your patch level: Settings → About phone → Software information → Android security patch level. You need 2026-09-05 or later.
Why this matters for your privacy and data
Zero-click RCE is the most dangerous vulnerability class: no user error, no granted permission — receiving a specially crafted file is all it takes. Historically, this exact attack vector has powered commercial spyware (Pegasus, Landfall, NoviSpy): an attacker sends an innocuous-looking message and the phone is fully compromised without the owner realising.
After successful exploitation, the attacker gains permissions equivalent to a standard Samsung application — enough to read the photo gallery, conversations, contacts, and location data, with a path toward full privilege escalation. Samsung's bulletin notes no active exploitation of CVE-2026-21095 or CVE-2026-21096 at the time of patch release: both were privately disclosed. But the Landfall case shows how quickly "no known exploitation" changes — weeks, not months.
Adding a network-layer defence reduces exposure to interception even on a compromised device: an encrypted VPN tunnel prevents eavesdropping at the Wi-Fi and ISP level. See what LiMP VPN protects — plans from $0.99/month on the pricing page.
What to do right now
1. Install the September patch today. If your Samsung Galaxy shows a pending update, do not delay. Patch level 2026-09-05 or later includes fixes for CVE-2026-21095 and CVE-2026-21096. Path: Settings → About phone → Software update → Download and install.
2. While unpatched, be cautious with images. Disable media auto-download in messaging apps: Telegram → Settings → Data and Storage → Auto-Download → uncheck all media from unknown contacts; WhatsApp → Settings → Storage and Data → similarly. This reduces the chance of automatic processing of a malicious file.
3. Keep Samsung Gallery and Camera apps updated. Check Galaxy Store for updates — they may carry additional fixes not included in the main system update.
4. Monitor Samsung's security bulletins. The official source is security.samsungmobile.com. SVE details are disclosed there after the vulnerability notification window closes.