Samsung fixes Android 0-day that may have been used to spy on WhatsApp messages

Samsung has fixed a critical flaw that affects its Android devices - but not before attackers found and exploited the bug, which could allow remote code execution on affected devices. The vulnerability, tracked as CVE-2025-21043, affects Android OS versions 13, 14, 15, and 16. It's due to an out-of-bounds write vulnerability in libimagecodec.quram.so, a parsing library used to process image formats on Samsung devices, which remote attackers can abuse to execute malicious code. "Samsung was notified that an exploit for this issue has existed in the wild," the electronics giant noted in its September security update. The Meta and WhatsApp security teams found the flaw and reported it to Samsung on August 13. Apps that process images on Samsung kit, potentially including WhatsApp, may trigger this library, but Samsung didn't name specific apps. The warning is interesting, because Meta shortly thereafter issued a security advisory warning that attackers may have chained a WhatsApp bug with an Apple OS-level flaw in highly targeted attacks. The WhatsApp August security update included a fix for CVE-2025-55177 that, as Meta explained, "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device." That security advisory went on to say, "We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted use...