CVE-2026-21095

A heap-based buffer overflow in Samsung's DNG decoder allows remote attackers to execute arbitrary code before the September 2026 SMR release.

This critical vulnerability (CVE-2026-21095) in Samsung's libimagecodec.quram.so enables remote code execution via a heap-based buffer overflow in the DNG decoder. DIB organizations must ensure all Samsung hardware and software components are patched before the September 2026 release to prevent attackers from gaining arbitrary code execution, which could compromise classified systems and violate CMMC/NIST 800-171 requirements. The vulnerability is not zero-day but is actively exploitable, highlighting the need for rigorous supply-chain validation and timely patching of vendor firmware.

Shame score — A critical CVSS 9.8 remote code execution vulnerability in Samsung's image codec library was exploitable before the September 2026 patch, demonstrating a failure to address high-severity flaws in time and exposing DIB systems to remote compromise.