>>23848274
Not same as meme, but quick search…
Yesterday?
LANDFALL…
Samsung Mobile Zero-Day Used to Deliver LANDFALL Android Spyware
NOVEMBER 12, 2025|IN SECURITY|BY SECURITY TEAM
In late 2024–2025 security teams discovered a targeted spyware campaign that abused a previously unknown Samsung image-processing vulnerability (tracked as CVE-2025-21042) to install a commercial-grade Android spyware family researchers call LANDFALL on Galaxy devices. Attackers weaponized specially crafted DNG (Digital Negative) image files — often disguised as ordinary WhatsApp images — to trigger an out-of-bounds write in Samsung’s image codec library and achieve remote code execution. The campaign appears targeted (reported primarily in the Middle East) and operated for months before Samsung issued a patch in April 2025.
Attack Description
Imagine receiving a photo through WhatsApp from someone you know — a normal, casual image. Behind the pixels, however, a malicious actor has embedded a crafted DNG file that takes advantage of a flaw in Samsung’s image-handling library. When the image is processed on the device (thumbnail generation, gallery preview, or system image parsing), the vulnerability triggers an out-of-bounds write that lets the attacker execute code inside the context of a privileged system component. That code then drops LANDFALL, which establishes persistent surveillance: recording audio, stealing files, tracking location, harvesting contacts and call logs, and exfiltrating data over covert channels.
Key points:
Delivery vector: crafted DNG image files appearing as WhatsApp images.
Exploited vulnerability: CVE-2025-21042 (image processing / libimagecodec).
Campaign timeline: activity observed since mid-2024; patch released by Samsung in April 2025.
Impact on Systems and Users
Direct impacts
Remote compromise of Samsung Galaxy devices without obvious user interaction (zero-day exploitation during image processing).
Full surveillance capabilities: microphone recording, camera capture, location tracking, file and contact exfiltration, interception/harvest of messages and call logs.
Persistence achieved by installing native components and hooking system services, making removal nontrivial without factory reset or OEM repair.
Indirect harms
Privacy violations for targets (activists, journalists, dissidents, corporate executives) — personal and professional secrets exposed.
Collateral compromise: attackers used widely-used messaging apps as a vector, increasing the chance of spreading to acquaintances and contacts.
Attribution and geopolitical risk: reporting suggests a Middle-East focus and potential links to private mercenary surveillance vendors, which raises regional political/privacy concerns.
Technical Description
This section walks through the vulnerability (CVE), the exploitation chain, and LANDFALL’s technical capabilities — written for security practitioners but explained in human terms.
CVE: CVE-2025-21042 — what, where, why it mattered
Identifier: CVE-2025-21042.
Component: an image-processing library used by Samsung devices — reported in research as libimagecodec.quram.so (the Samsung image codec).
Type of flaw: Out-of-bounds write during parsing of certain DNG (RAW) image features. An attacker can craft an image that, when parsed, writes outside expected memory bounds — enabling memory corruption and arbitrary code execution.
Impact: Remote code execution in a privileged component that processes images; this can be triggered by receiving or opening an image, or by background image processing that happens automatically (thumbnailing, gallery indexing).
Severity / scoring: Published reports give a high severity (example: CVSS ~8.8 reported in coverage), reflecting remote exploitation potential and high impact.
Patch: Samsung released a patch addressing the vulnerability in April 2025. Devices updated after that point should no longer be vulnerable to the original exploit.
moar
https://cybersrcc.com/2025/11/12/samsung-mobile-zero-day-used-to-deliver-landfall-android-spyware/#:~:text=Samsung%20Mobile%20Zero%2DDay%20Used%20to%20Deliver%20LANDFALL%20Android%20Spyware,-November%2012%2C%202025&text=In%20late%202024%E2%80%932025%20security,a%20patch%20in%20April%202025.