Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Until a patch is applied, implement network segmentation to restrict access to systems running applications dependent on libimagecodec.quram.so, especially from untrusted external networks. Configure affected services to run with the principle of least privilege or within a sandboxed environment to limit the impact of successful code execution. Enhance monitoring for unusual process activity or outbound network connections originating from systems utilizing the vulnerable library.
The permanent resolution is to update libimagecodec.quram.so to SMR Apr-2025 Release 1 or a newer version as provided by the vendor. Ensure all systems running applications that rely on this library are upgraded promptly to the patched release. Verify the successful installation of the security update to confirm the vulnerability has been addressed.
A remote attacker can exploit this out-of-bounds write vulnerability to execute arbitrary code with the privileges of the affected application. This could lead to a full system compromise, allowing for data exfiltration, service disruption, or further lateral movement within the network. The business consequences include potential data breaches, significant reputational damage, and operational downtime.
Other CVEs affecting android
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.