In-the-wild Android RCE via malicious DNG opcodes against Sa...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://projectzero.google/2025/12/android-itw-dng.html
• Blog Title: In-the-wild Android RCE via malicious DNG opcodes against Samsung Quram in com.samsung.ipservice
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subpage on "Abusing Android Media Pipelines & Image Parsers" referencing this Quram/DNG opcode exploitation), cross-linked from Binary Exploitation -> Common Exploiting Problems or a new "Image/Media Parsing Exploits (DNG/TIFF/JPEG)" subsection.

🎯 Content Summary

Between July 2024 and February 2025, multiple malicious image files were uploaded to VirusTotal. They are actually DNG (Digital Negative) images exploiting a Samsung-specific image parsing library, Quram, used inside the Samsung system service com.samsung.ipservice. A Samsung vulnerability (patched around April 2025, with a CVE in the original blog) enables remote code execution (RCE) when Quram parses a crafted DNG. The main delivery vector is WhatsApp on Android: when WhatsApp downloads an ima...

🔧 Technical Details

1. Abuse of WhatsApp → MediaStore → Samsung AI pipeline: The attack leverages the automatic media-handling chain on Samsung Android devices. A malicious DNG, disguised with a .jpg or .jpeg extension, is sent via WhatsApp. When the user taps to download it, WhatsApp writes the file into Android's MediaStore. Samsung's com.samsung.ipservice system service then scans/parses these images using Quram to power "intelligent" features, triggering parsing of the exploit in a privileged process even if the user never opens the image in Samsung's gallery.

2. Exploiting DNG opcode lists for heap overflow: DNG supports three opcode lists applied at different decoding stages. Quram implements a custom interpreter for these opcodes but lacks adequate parameter validation. The attacker fills Opcode Lists 1 and 2 with thousands of instances of opcode 23 and uses stage-3 opcodes like TrimBounds and DeltaPerColumn to tamper with image dimensions and indexing. Crafted parameters (dimensions, strides, cou...

🤖 Agent Actions

Summary

• Added a new “Abusing Android Media Pipelines & Image Parsers” page detailing how malicious DNG opcode lists weaponize Samsung’s Quram decoder: delivery through WhatsApp → MediaStore, the DeltaPerColumn plane-bounds bug, heap shaping on scudo, opcode repurposing for data/JOP chains, ASLR bypass via bogus MapTables, and defensive insights.
• Linked the new content from the Android pentesting index under “Case Studies & Vulnerabilities” so readers can discover the media-pipeline attack guidance.
• Introduced an “Image/Media Parsing Exploits (DNG/TIFF/JPEG)” subsection in Common Exploiting Problems to highlight how parser-opcode engines become R/W primitives, and pointed it to the new deep-dive.

Testing

• Not applicable (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://projectzero.google/2025/12/android-itw-dng.html

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subpage on "Abusing Android Media Pipelines & Image Parsers" referencing this Quram/DNG opcode exploitation), cross-linked from Binary Exploitation -> Common Exploiting Problems or a new "Image/Media Parsing Exploits (DNG/TIFF/JPEG)" subsection.".

Repository Maintenance:

• MD Files Formatting: 925 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge