Samsung has released its monthly security patch fixing two critical zero-click vulnerabilities in its Galaxy smartphones that could allow remote code execution through a malicious image file, according to Google Project Zero researchers. The bugs, which carry a severity score of 9.2 out of 10, require no user interaction or manual confirmation to trigger.
Discovered by Brendon Tiszka and Mateusz Jurczyk of Google Project Zero, the vulnerabilities are tracked as CVE-2026-21095 and CVE-2026-21096. According to the security disclosure, both flaws target libimagecodec.quram.so, the native library responsible for handling image decoding across Samsung Galaxy devices. The first vulnerability impacts the DNG raw image format produced by digital cameras, while the second affects standard JPEG files. Both bugs stem from a buffer overflow that can lead to remote code execution.
According to Samsung’s security advisory, the patches are included in the September software release designated as SMR Sep-2026 Release 1. The vulnerabilities impact devices running Android 14, 15, 16, and 17. Security researchers confirmed that no active exploitation of these image-processing flaws has been detected in the wild.
How Zero-Click Image Attacks Work on Android
Zero-click exploits represent a severe category of security threat because victims do not need to click a link, download an app, or approve a file transfer. Once the Android operating system attempts to render or parse the malformed image header through the vulnerable Quram image codec library, the memory buffer overflows.
Google Project Zero privately reported the flaws to Samsung prior to public disclosure. Because image parsing libraries operate with high-level system permissions to render thumbnails and previews automatically, a successful buffer overflow can grant malicious code access to core device functions without leaving visible indicators for the device owner.
Checking and Installing the Samsung September 2026 Patch
Samsung distributes security updates via its One UI software update channels in phases, depending on the specific Galaxy model and regional carrier availability. Older devices often receive these packages slightly later in the deployment cycle.
Galaxy users can verify their current protection status by opening device settings:
- Open the Settings app on your Samsung Galaxy device.
- Scroll down and select Software update.
- Tap on Download and install or check Software information.
- Verify the date listed under the Android security patch level. If the date reads September 2026 or later, the device has received protection against CVE-2026-21095 and CVE-2026-21096.
Related reading