A LOOK AT AN ANDROID ITW DNG EXPLOIT

Summary from the TLDR InfoSec newsletter

Google Project Zero analyzed in-the-wild DNG image exploits targeting Samsung's Quram image parsing library (CVE-2025-21042), discovered through suspicious files uploaded to VirusTotal that were distributed via WhatsApp and exploited Samsung's com.samsung.ipservice process when images were automatically scanned. The vulnerability allowed out-of-bounds writes through malformed DNG opcode parameters, which attackers leveraged to corrupt heap metadata, bypass ASLR through crafted MapTable operations that leaked library addresses, construct JOP chains, and ultimately achieve system() command execution to deploy spyware—all without control flow integrity mitigations like PAC/BTI present in the Quram library. Samsung silently patched the vulnerability in April by adding bounds checks to prevent plane index overflows. The case demonstrates how image format specifications provide powerful exploitation primitives that enable single-bug exploits to achieve interactionless remote code execution and access to all media store contents, capabilities that would likely have been prevented by MTE deployment.