Samsung Galaxy Devices Targeted by LANDFALL Spyware via Critical Zero-Day

A critical vulnerability in Samsung mobile devices, identified as CVE-2025-21042, has been actively exploited in the wild, allowing attackers to deploy the LANDFALL spyware. This zero-day flaw, which affects the libimagecodec.quram.so library, enables remote code execution through an out-of-bounds write, posing a severe threat to users of Samsung Galaxy devices. The vulnerability, with a CVSS score of 9.8, was disclosed on September 12, 2025, and has since been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of November 10, 2025. The exploitation of this flaw was notably swift, with attackers leveraging it within 58 days of its disclosure, underscoring the urgency for affected users to apply available patches. The LANDFALL spyware campaign has primarily targeted Samsung Galaxy devices in the Middle East, exploiting this zero-day vulnerability via malicious DNG image files sent through WhatsApp. This method of delivery allows attackers to execute arbitrary code on the victim's device, effectively compromising the device's security and privacy. The spyware is capable of accessing sensitive information, including messages, call logs, and potentially other personal data stored on the device. Security researchers have confirmed the availability of a proof-of-concept (PoC) exploit, which has likely facilitated the rapid adoption of this attack vector by threat actors. The exploitation of CVE-2025-21042 highlights the persistent threat posed by zero-day vulnerabilities, particularly in widely used mobile platforms like Samsung's. Samsung has addressed this vulnerability in its April 2025 security release, urging users to update their devices to mitigate the risk of exploitation. Given the critical nature of this flaw and its active exploitation, it is imperative for users to ensure their devices are running the latest firmware updates. For cybersecurity teams, monitoring for indicators of compromise related to the LANDFALL spyware is crucial. This includes scrutinizing network traffic for unusual patterns and inspecting devices for unauthorized access attempts. Additionally, organizations should reinforce their security awareness programs to educate users about the risks of opening unsolicited image files, particularly those received via messaging platforms like WhatsApp. The swift exploitation of CVE-2025-21042 serves as a stark reminder of the importance of timely patch management and the need for robust security measures to protect against sophisticated spyware campaigns. As attackers continue to exploit zero-day vulnerabilities, maintaining vigilance and proactive defense strategies remain essential for safeguarding sensitive information and maintaining the integrity of mobile devices.