CVE-2025-58478: 
NixOS vulnerability analysis and mitigation

CVE-2025-58478 is an out-of-bounds write vulnerability in libimagecodec.quram.so, a Samsung image codec library present on Samsung Android devices. The flaw allows remote attackers to access out-of-bounds memory by sending crafted image data to a vulnerable device. It affects Samsung Android versions 13, 14, 15, and 16 prior to the SMR Dec-2025 Release 1 patch. The vulnerability was published on December 2, 2025, and carries a CVSS v3.1 base score of 7.5 (High) per NVD, though ENISA's EUVD rates it 4.3 (Medium) with a different vector reflecting required user interaction (Samsung Advisory, Red Hat CVE).

The root cause is an out-of-bounds write (CWE-787) in the libimagecodec.quram.so shared library, which handles image decoding on Samsung devices. An attacker can exploit this by delivering a specially crafted image file that, when processed by the vulnerable codec, causes the library to write data beyond the bounds of an allocated memory buffer. The NVD CVSS vector indicates network-based exploitation with no privileges required and no user interaction, while ENISA's assessment suggests low user interaction may be involved (e.g., opening a malicious image). No public proof-of-concept code has been identified at this time (Samsung Advisory, ENISA EUVD).

Successful exploitation could allow a remote attacker to access out-of-bounds memory on the affected Samsung device, with the primary risk being unauthorized memory reads that expose sensitive data (high confidentiality impact per NVD). ENISA's assessment characterizes the impact as low integrity impact with no confidentiality or availability impact, reflecting uncertainty about the precise exploitation outcome. The vulnerability affects a broad range of Samsung devices running Android 13 through 16, representing a large installed base of consumer and enterprise mobile devices (Samsung Advisory, ENISA EUVD).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2025-58478. The EPSS score is approximately 0.039% (0.000390), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Sploitus references to exploit entries appeared in later months (June–July 2026), but no confirmed weaponized exploit has been attributed to a specific threat actor (Samsung Advisory, Red Hat CVE).

Samsung has released a patch in the SMR Dec-2025 Release 1 security update, which addresses this vulnerability across Android 13, 14, 15, and 16. Users should apply the December 2025 Samsung Security Monthly Release (SMR) as soon as it becomes available for their device. As interim mitigations, users should avoid opening image files from untrusted or unknown sources, keep all system software and applications up to date, and consider using reputable mobile security solutions. No configuration-based workaround has been published by Samsung (Samsung Advisory).

Coverage of CVE-2025-58478 has been limited to standard vulnerability tracking and aggregation platforms such as Vulners, CVEFeed, VulDB, and CIRCL, with no notable independent researcher commentary or significant social media discussion identified. Samsung's December 2025 security patch details were covered by Samsung-focused community sites such as SammyFans. Red Hat also tracked the CVE for potential relevance to their products (Red Hat CVE).