Samsung Galaxy S25 Vulnerable to Remote Code Execution via TIFF File Parsing Flaw
A critical heap-based buffer overflow in Samsung Galaxy S25 devices allows remote attackers to execute arbitrary code by processing a specially crafted TIFF file.
Samsung's flagship Galaxy S25 smartphone is facing a significant security threat due to a newly disclosed vulnerability that could allow attackers to execute arbitrary code remotely. The flaw, identified as ZDI-26-529 and assigned CVE-2026-21045, resides within the device's TIFF file processing component.
The vulnerability stems from an improper validation of user-supplied data length before it is copied into a heap-based buffer. This oversight creates a heap-based buffer overflow condition, which attackers can exploit to overwrite memory and inject malicious code. Successful exploitation would allow an attacker to execute code within the context of the current process, potentially leading to a complete compromise of the affected device.
To trigger this vulnerability, an attacker would typically need to trick the user into interacting with a malicious element. This could involve convincing the user to visit a compromised webpage that hosts a specially crafted TIFF file or to open a malicious TIFF file directly. The CVSS score for this vulnerability is rated at a high 8.8, underscoring its severity and the potential impact on users.
Samsung has acknowledged the vulnerability and has already released a security update to address the issue. Users are strongly advised to apply the latest security patches available for their Galaxy S25 devices to mitigate this risk. The update details can be found on Samsung's official security portal.
The vulnerability was discovered by Dvir Gozlan and was reported to the vendor on May 6, 2026. The Zero Day Initiative (ZDI) coordinated the public release of the advisory on August 11, 2026, after Samsung had prepared a fix. This timeline reflects a typical responsible disclosure process, aiming to protect users while informing the public about potential threats.
This discovery highlights the persistent challenges in securing complex mobile operating systems and applications. File parsing libraries, often handling a wide variety of formats, remain a common attack vector. The ability to achieve remote code execution through a seemingly innocuous file format like TIFF underscores the need for continuous security auditing and robust input validation in all software components.
While the immediate threat is mitigated by the available patch, the existence of such a vulnerability serves as a reminder for users to exercise caution when handling files from unknown or untrusted sources. Keeping devices updated with the latest security patches is a crucial step in defending against sophisticated cyber threats.