LANDFALL: the Samsung codec bug behind a targeted spyware campaign

LANDFALL reached public attention through spyware samples tied to malicious image processing on Samsung devices. The visible messaging app was only part of the story. Samsung’s vulnerable native codec had its own fix, and the recovered material did not explain every step needed for the broader compromise.

What Unit 42 recovered

Unit 42 reports LANDFALL samples associated with activity from mid-2024 into 2025 and links malicious DNG image processing to CVE-2025-21042. Filenames supported an assessment of WhatsApp delivery, but the researchers did not identify an additional unknown WhatsApp vulnerability. They also did not recover the additional exploits needed to explain the complete broader compromise. The recovered spyware supported collection of sensitive device information, including audio and location data.

Unit 42’s original LANDFALL investigation

A messaging delivery route does not establish a new bug in the messenger. Likewise, a malicious image does not prove that one parser flaw alone defeated every permission check on the device. Broader access needs evidence for the additional steps.

The flaw Samsung patched

Samsung identifies SVE-2024-1969, assigned CVE-2025-21042, as an out-of-bounds write in libimagecodec.quram.so. Its April 2025 bulletin lists Android 13, 14 and 15, rates the issue critical, and says improved input validation addresses the defect in SMR Apr-2025 Release 1. Samsung records a September 25, 2024 report date.

Samsung’s April 2025 security maintenance release

Keep the September report date, first fix, campaign activity and later public analysis separate. A campaign can become widely discussed after a correction is already available. The CVE’s public assignment date also does not identify when the vulnerable code first became exploitable.

What the DNG decoder has to handle

Adobe describes Digital Negative, or DNG, as a public archival format for raw image data. A raw-image format carries information that software must interpret before presenting a finished image. Supporting a format is therefore more than recognizing an icon or trusting a filename extension.

Adobe’s description of the DNG format

A decoder must reconcile the encoded dimensions, available input, calculated output capacity and permitted writes. A plausible outer container can still hold inconsistent internal values. A familiar filename extension also cannot tell you which parser will ultimately receive the contents.

An out-of-bounds write changes memory beyond the operation’s valid region. Depending on the process and its protections, that may cause a crash or more consequential corruption. Samsung identifies this weakness and its validation fix, but does not publicly describe the complete malformed structure used in the campaign.

The questions a recovered image cannot answer alone

Android’s SELinux design enforces mandatory access controls, including restrictions on privileged processes. Those controls make process context central to the analysis. Code execution in a decoder should not automatically be described as unrestricted access to every application’s data.

Android’s SELinux design and enforcement model

The missing steps belong in the account of the findings. Defenders can prioritize the exploited codec fix without claiming to know the full route from image decoding to each spyware capability. Keep recovered artifacts, vendor-confirmed defects and analyst assessments clearly attributed.

Related codec bugs are not automatically the same campaign

Unit 42 distinguishes CVE-2025-21042 from CVE-2025-21043, another issue in the same codec addressed later in 2025. It did not find the latter in the recovered LANDFALL samples. Shared components and overlapping infrastructure do not by themselves establish identical exploits or a definitive common operator.

Unit 42’s distinction between the related codec findings

CISA added CVE-2025-21042 to its Known Exploited Vulnerabilities catalog on November 10, 2025. For an affected device, that is a reason to verify the repair promptly, even though Samsung’s first correction preceded the catalog entry.

CISA’s Known Exploited Vulnerabilities catalog

Check the Samsung firmware build

Record the exact Samsung model, installed firmware and security maintenance level, then match them to Samsung’s applicable release. Updating WhatsApp cannot verify that the device’s native codec changed. This Samsung-specific library finding also cannot be extended to every Android manufacturer without evidence.

If credible evidence suggests targeting, preserve the device and relevant records before an improvised cleanup destroys context. Review sensitive account access from a trusted endpoint and coordinate recovery with a responder. Repairing the parser addresses the flaw; determining which historical data was accessed requires the investigation.

Source check: September 8, 2026. This article examines a historical Samsung-targeting spyware campaign investigated by Palo Alto Networks Unit 42, together with Samsung’s public correction. It does not claim that Short Circuit LLC recovered or analyzed the malware.