CVE-2025-58479: 
NixOS vulnerability analysis and mitigation

CVE-2025-58479 is an out-of-bounds read vulnerability in the libimagecodec.quram.so library on Samsung Android devices that allows remote attackers to access out-of-bounds memory. It affects Samsung Android versions 13, 14, 15, and 16 prior to the SMR Dec-2025 Release 1 security patch. The vulnerability was published on December 2, 2025, and patched in Samsung's December 2025 Security Monthly Release. It carries a CVSS v3.1 base score of 7.5 (High) per NVD scoring, with an alternative ENISA scoring of 4.3 (Medium) (Samsung Advisory, Red Hat CVE).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in libimagecodec.quram.so, a shared library responsible for image codec processing on Samsung devices. A remote attacker can send specially crafted network requests — likely involving maliciously formed image data — that trigger the library to read beyond the bounds of an allocated memory buffer. No authentication or user interaction is required under the NVD scoring (AV:N/AC:L/PR:N/UI:N), making this exploitable remotely without preconditions. The attack pattern aligns with CAPEC-540 (Overread Buffers) (Samsung Advisory, Red Hat CVE).

Successful exploitation results in unauthorized read access to out-of-bounds memory regions, leading to information disclosure. Sensitive data stored in adjacent memory — such as cryptographic material, session tokens, or personal data — could be exposed to the attacker. Integrity and availability are not directly impacted by this vulnerability; the primary risk is confidentiality loss on affected Samsung devices running Android 13 through 16 (Samsung Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 610754), enabling scanner-based identification of unpatched devices.

Samsung has addressed this vulnerability in the SMR Dec-2025 Release 1 security patch, applicable to Samsung Android versions 13, 14, 15, and 16. Users should apply the December 2025 Samsung security update as soon as it becomes available for their device. As an interim measure, users should avoid opening or processing images from untrusted or unknown sources, and organizations should deploy endpoint security solutions capable of detecting anomalous memory access behavior (Samsung Advisory).