WhatsApp Image Zero-Day Hits Samsung Galaxy: Patch Now

Update your Galaxy with Samsung’s September security patch to block a WhatsApp-linked image exploit targeting Android 13–16 via the device’s image-parsing library.

Samsung has issued an urgent warning to Galaxy users after confirming a zero-day vulnerability that allowed attackers to run malicious code on affected devices simply by delivering a crafted image. The flaw—tracked as CVE-2025-21043—resides in Samsung’s image-parsing library (libimagecodec.quram.so) used by apps that process pictures, including popular messengers. Meta’s and WhatsApp’s security teams reported the issue to Samsung; the company says the exploit was active in the wild before a fix became available. The patch is included in Samsung’s September 2025 Security Maintenance Release (SMR) and is rolling out now.

Who is affected?

Samsung says devices running Android 13 or newer (13, 14, 15, and 16) are impacted, which effectively covers most Galaxy models released in the past several years. Because the vulnerable library underpins image decoding on Samsung devices, the exposure extends beyond a single app—even though WhatsApp helped surface the problem The Register.

How the attack works

This is a zero-click/low-click remote code-execution scenario: threat actors can booby-trap an image so that, when processed by the vulnerable library, malicious code runs on the target device. In practice, that image can arrive through a messenger, email, or another channel that triggers decoding. Security analysts warn that such flaws are prized for espionage and financially motivated campaigns because they minimize user interaction.

The fix—and why some users won’t see it immediately

Samsung has begun shipping the September 2025 security update to a growing list of models. As usual, distribution is staged by device, region, and carrier, which means some owners will see the patch before others. To check manually: Settings → Software update → Download and install. If it’s available for your device, install it immediately. Multiple independent outlets have corroborated the rollout and the link to CVE-2025-21043 PhoneArena.

About that One UI 8 / Android 16 update

In parallel with the security patch, Samsung is also pushing One UI 8 (Android 16) to select models—beginning with the latest flagships and expanding in waves. Important: the security fix for CVE-2025-21043 comes via the September SMR, and you do not need to be on Android 16 to receive protection. However, One UI 8 brings additional platform-level security and privacy improvements as part of Samsung’s broader 2025 software cycle Samsung Newsroom.

Why this matters

Remote code execution (RCE) on phones that handle banking, 2FA, email, and corporate apps is a high-impact risk. A successful exploit can lead to device compromise, credential theft, or data exfiltration. Security researchers emphasize that image-parsing vulnerabilities are particularly dangerous because virtually every modern app displays images and thumbnails, increasing the chances of automatic processing.

What you should do now

• 1. Update your Galaxy device: Install the September 2025 security patch as soon as it appears. Reboot after installation PhoneArena.
• 2. Update WhatsApp and other messengers: Keep your messaging apps on the latest versions; vendors often ship mitigations even before OEM patches land.
• 3. Harden your settings while you wait: If the patch hasn’t arrived for your model, consider disabling auto-download of media in messengers, avoid opening images from unknown contacts, and keep Play Protect and all apps updated. Consumer security outlets additionally suggest using reputable security tools and practicing good password hygiene.

Am I vulnerable if I don’t use WhatsApp?

Possibly. The flaw lives in Samsung’s image-parsing library, which can be exercised by multiple apps that handle images, not only WhatsApp. WhatsApp’s team helped report the issue, but the vulnerable code isn’t unique to a single app. Installing the September patch is the definitive fix.

Do I need Android 16 (One UI 8) to be safe?

No. The security patch is part of September’s SMR and applies to eligible devices regardless of their major OS version. One UI 8 is a separate upgrade track with additional features and security enhancements, but CVE-2025-21043 is addressed by the monthly patch.

How will I know if the update is available?

Go to Settings → Software update → Download and install. Because Samsung staggers releases by market and model, you might see a several-day delay versus other regions. Keep checking.

What makes this vulnerability “zero-day”?

“Zero-day” means attackers exploited the bug before a patch was widely available. Samsung acknowledged in its advisory that an exploit already existed in the wild, prompting an accelerated fix.

Could viewing a photo in the gallery be enough to get hacked?

The risk stems from the decoding step—which can occur when an app previews or thumbnails an image. Exact exploit paths vary, but because decoding often happens automatically, treat unknown images as untrusted until you’ve patched.

What’s the worst-case scenario if I don’t update?

RCE vulnerabilities can let attackers install malware, harvest data, or pivot into accounts and corporate apps. The longer a device stays unpatched, the greater the exposure—especially if adversaries automate delivery of weaponized images.

The bigger picture

This incident underlines a recurring theme in mobile security: media codecs and image libraries are prime targets because they are universally used and often process untrusted content by default. Google’s broader September Android bulletin also fixed other actively exploited flaws, reminding users and fleet admins that monthly updates are not optional. The practical playbook is simple but non-negotiable: apply patches quickly, keep apps current, and minimize attack surfaces until updates arrive. In summary

In summary

• Install Samsung’s September 2025 update the moment it hits your device.
• Update WhatsApp and other messaging apps to their latest versions.
• Reduce exposure (disable auto-media downloads, avoid unknown senders) until you’re patched.
• Treat the One UI 8 rollout as complementary—great if you get it, but the SMR is the fix for CVE-2025-21043.

Source: The Register PhoneArena Samsung Newsroom