Skip to content

CVE-2025-21042 Deep Dive: Samsung Zero-Click Zero-Day Exploited by LANDFALL Spyware

A critical zero-day vulnerability, identified as CVE-2025-21042, affecting Samsung Android devices has been actively exploited in the wild to deploy sophisticated commercial-grade spyware known as LANDFALL. This zero-click exploit poses a severe threat, allowing attackers to compromise devices without any user interaction.

Executive Summary

Unit 42 researchers have detailed an exploit chain leveraging CVE-2025-21042, an RCE flaw in Samsung's Android image processing library. The attack involves sending a malformed Digital Negative (DNG) image file, often via messaging apps like WhatsApp. Simply receiving and processing this image is enough to trigger the vulnerability, leading to remote code execution and the installation of LANDFALL spyware. This vulnerability highlights the ongoing threat from private-sector offensive actors (PSOs) and the critical need for timely mobile security updates.

Vulnerability Details

  • CVE ID: CVE-2025-21042
  • Vulnerability Type: Remote Code Execution (RCE) - Zero-Click
  • Vendor: Samsung
  • Affected Products: Samsung Android devices, specifically targeting a vulnerability within Samsung's image processing library.
  • Root Cause: The vulnerability resides in how Samsung's image codec library processes Digital Negative (DNG) image files. A specially crafted DNG image can trigger an RCE, indicating a memory corruption flaw or similar issue during image parsing.
  • Exploitation Status: Actively exploited as a zero-day in the wild by sophisticated actors.
  • Attack Vector: Remote, zero-click. Malformed DNG image file sent via messaging applications (e.g., WhatsApp).
  • Impact: Complete device compromise, remote code execution, deployment of LANDFALL spyware, full control over the victim's phone, data exfiltration, surveillance.
  • CVSS v3.1 Base Score: Likely 9.8 - 10.0 (Critical) based on typical RCE zero-click characteristics (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Attack Chain: The Zero-Click Mechanism

The exploit chain for CVE-2025-21042 is particularly insidious due to its zero-click nature. The general flow is as follows:

  1. Malicious DNG Delivery: The attacker sends a booby-trapped DNG image file to the victim's Samsung phone, often via a messaging application like WhatsApp. These DNG files are armed with ZIP archive payloads and tailored exploit code.
  2. Automatic Image Processing: The Samsung device automatically processes the incoming image file, even if the user doesn't explicitly open it, for purposes like preview generation or thumbnail creation.
  3. Vulnerability Trigger: During this automatic processing, the malformed DNG file triggers the RCE vulnerability within Samsung's image codec library.
  4. Code Execution & Spyware Deployment: The vulnerability allows arbitrary code execution on the device, leading to the installation of the LANDFALL spyware without any interaction from the user.

This highlights the danger of vulnerabilities in default system processes that handle untrusted input, even seemingly benign data like image files.

LANDFALL Spyware

LANDFALL is described as a commercial-grade Android spyware, indicating it possesses advanced capabilities for surveillance and data exfiltration. Such spyware is typically used by governments or private entities for targeted attacks against high-value individuals.

Samsung also patched another similar zero-day vulnerability (CVE-2025-21043) in the same image processing library in September, further protecting against this type of attack. This suggests a pattern of vulnerabilities within this specific component, potentially indicating a broader security weakness.

Proof-of-Concept (PoC)

Due to the nature of this vulnerability being actively exploited by sophisticated actors (likely private-sector offensive actors) and its zero-day status, a public, verifiable PoC exploit is not readily available. These types of exploits are highly guarded by their developers. However, the attack mechanism is clearly defined:

  • Payload: Specially crafted Digital Negative (DNG) image file containing exploit code and LANDFALL spyware within ZIP archives.
  • Delivery: Typically via messaging applications (e.g., WhatsApp) to a target Samsung device.

The absence of a public PoC emphasizes the criticality for users to apply vendor patches diligently.

Detection & Mitigation

Detection

Detecting zero-click exploits like CVE-2025-21042 can be extremely challenging, as they leave minimal forensic artifacts at the initial compromise stage. However, indicators of compromise (IoCs) related to the LANDFALL spyware or unusual network activity after compromise might be detectable:

  • Network Anomalies: Monitor device network traffic for suspicious connections to known spyware command-and-control (C2) servers or unusual data exfiltration patterns.
  • Device Behavior: Look for abnormal battery drain, unexpected app installations, or increased data usage, which could indicate spyware activity.
  • Endpoint Detection and Response (EDR): Advanced mobile EDR solutions might be able to detect the installation and activity of LANDFALL spyware.

Mitigation

  1. Prompt Updates: The most crucial mitigation is to apply all available operating system and security updates from Samsung immediately. These updates contain patches for such critical vulnerabilities.
  2. App Permissions Review: Regularly review and restrict unnecessary permissions for messaging and other applications, especially those that handle media files.
  3. Cautious Media Handling: While this is a zero-click, being generally cautious about receiving unsolicited media files from unknown senders is always a good practice.
  4. Secure Messaging Apps: Use messaging applications with strong end-to-end encryption and robust security features that actively filter or sanitize incoming media.
  5. Mobile Threat Defense (MTD): Implement Mobile Threat Defense solutions on organizational devices for advanced threat detection and prevention.

Conclusion

CVE-2025-21042 represents a significant and concerning development in mobile security, demonstrating the continued sophistication of zero-day exploits and spyware. The zero-click nature of this vulnerability underscores the need for users to keep their devices updated with the latest security patches and for organizations to deploy comprehensive mobile threat defense strategies. As PSOs continue to evolve their tactics, proactive patching and vigilance remain paramount for protecting against such potent threats.

References

Comments (0)

Loading comments...