CVE-2026-21096

A heap-based buffer overflow in Samsung's JPEG decoder allows remote attackers to execute arbitrary code.

This critical vulnerability in Samsung's libimagecodec.quram.so library enables remote code execution via a heap-based buffer overflow in the JPEG decoder. DIB organizations must patch this flaw immediately as it represents a severe exposure to unauthenticated remote attackers, directly impacting compliance with NIST 800-171 requirements for mitigating known vulnerabilities. The failure stems from unpatched, exploitable code in a widely deployed library, highlighting the risk of relying on third-party components without rigorous supply-chain validation.

Shame score — A critical CVSS 9.8 remote code execution vulnerability in a widely deployed Samsung library was left unpatched and exploitable, representing a severe, avoidable failure in supply-chain security and vulnerability management.