CVE-2026-21045 & CVE-2026-21048 — Samsung libimagecodec.quram.so OOB Write PoC

Overview

This repository contains conceptual Proof-of-Concept (PoC) files that demonstrate out-of-bounds (OOB) write vulnerabilities in the Quramsoft image codec library (libimagecodec.quram.so) used on Samsung Android devices.

Affected Devices

• Samsung Galaxy devices running Android 14, 15, 16
• Specifically: Galaxy Z Fold 7, Flip 7, S-series, A-series (e.g., A17)
• Devices with security patch prior to SMR Jul-2026 Release 1
• Library: /system/lib64/libimagecodec.quram.so

Vulnerability Mechanism

Root Cause

The vulnerability resides in the IFD (Image File Directory) tag parsing function WINKJ_ReadExifField (offset 0x13a0a8 in the 64-bit binary). This function processes individual TIFF/EXIF IFD entries, each being a 12-byte structure:

Offset  Size  Field
------  ----  -----
0       2     Tag ID
2       2     Data Type (1=BYTE, 2=ASCII, 3=SHORT, 4=LONG, 5=RATIONAL, etc.)
4       4     Count (number of values)
8       4     Value / Offset to data

When count * element_size > 4, the 4-byte Value field is treated as a file offset (pointing to where the actual data lives). The code then performs a bounds check at address 0x13a258:

add w8, w6, w7    ; w8 = value_offset + (count * element_size)  [32-bit]
cmp w8, w5        ; compare against remaining buffer size
b.ls ok           ; if w8 <= buffer_size, proceed

Integer Overflow Bypass

The vulnerability is a 32-bit unsigned integer overflow in the addition. If an attacker crafts value_offset and count * element_size such that their sum wraps around to a small value, the check passes even though the actual memory access at base + value_offset goes out of bounds.

Example (UNDEFINED type, element_size = 1):

The 32-bit addition 0x17FFF + 0xFFFF0001 = 0x10008000 truncates to 0x8000, which equals buffer_size. The check passes, but the actual data pointer (base + 0x17FFF) lies 0x7FFF bytes past the end of the allocated buffer.

Vulnerable Code Path

TIFFReadDirectory / WINKJ_ReadTiffInfo
  └─> WINKJ_ReadTiffIFDInfo   (allocates IFD buffer)
       └─> for each IFD entry:
            └─> WINKJ_ReadExifField   (parses entry, reads value data)
                 └─> Switch on Data Type (jump table at 0x13a15c)
                      ├─ Type 0 (BYTE/ASCII/UNDEFINED):  handler at 0x13a15c
                      ├─ Type 3/8 (SHORT/SSHORT):       handler at 0x13a1d0
                      ├─ Type 4/9/11 (LONG/SLONG/FLOAT): handler at 0x13a17c
                      └─ Type 5/10/12 (RATIONAL/SRATIONAL/DOUBLE): handler at 0x13a1ac
                      Each handler -> reads data at offset -> bounds check at 0x13a258

PoC Files

Usage

# Generate TIFF PoC
python3 cve-2026-21045_tiff_oob_poc.py -o payload.tif

# Generate DNG PoC
python3 cve-2026-21048_dng_oob_poc.py -o payload.dng

# Transfer to device and trigger (e.g., via Gallery/MMS)
adb push payload.tif /sdcard/Download/
adb shell am start -a android.intent.action.VIEW -d file:///sdcard/Download/payload.tif -t image/tiff

Expected Behavior

On an unpatched device (security patch < July 2026), opening the crafted TIFF/DNG file in Samsung Gallery (or any app using the Quram decoder) should cause a heap memory corruption potentially leading to:

• Application crash (SIGSEGV/SIGABRT)
• Out-of-bounds heap write
• Under specific heap layouts: potential arbitrary code execution

On a patched device (SMR Jul-2026+), the image should either be rejected as invalid or processed safely. A crash on a fully-patched device may indicate a separate unpatched issue.

Binary Analysis Details

Library Info

File:   libimagecodec.quram.so (64-bit)
SHA256: (verify against your copy)
NDK:    r23c (Android 21)
Built:  2021-12-31 (placeholder date)
Soname: libimagecodec.quram.so

Key Functions

Dispatch Table (Tag Type → Handler)

Extracted from WINKJ_ReadExifField:

All types with element_size = 1 (BYTE, ASCII, UNDEFINED) share the same handler and are equally vulnerable to the integer overflow bypass.

Related CVEs

Disclaimer

These proofs of concept are provided for educational and security research purposes only. They demonstrate the vulnerability mechanism to help users and developers understand the risk. Do not use them against systems you do not own or have explicit permission to test.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-21045
• https://nvd.nist.gov/vuln/detail/CVE-2026-21048
• https://security.samsungmobile.com/securityUpdate.smsb
• https://gitlab.com/libtiff/libtiff/-/releases/v4.6.0