The Patching Friars' AlmanacA calendar of CVE saints

November 7

LANDFALLHoly card for landfall, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 LANDFALL IMAGO IN LITUS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint LANDFALL, Who Came Ashore From the Images

Patron of Samsung Galaxy phones, image-decoding libraries, and everyone who receives a photo from a stranger.

Life

On 7 November 2025 Unit 42 of Palo Alto Networks described LANDFALL, commercial spyware that exploited an out-of-bounds write in libimagecodec.quram.so, the image-decoding library on Samsung phones (CVE-2025-21042). Simply delivering a crafted image was enough for the phone to run the attacker's code while processing it. It was used in targeted attacks before Samsung fixed it in the April 2025 bulletin.

Prayer

O Saint LANDFALL, who comes ashore from a mere photo, let our image libraries not run what they decode. Amen.

How to celebrate

Celebrated by installing the Samsung security updates and distrusting images received from unknown senders.

Open every image and you open the door too.

Technical record

Disclosed on
November 7 2025
CVE
CVE-2025-21042
CVSS
8.8Actively exploited (CISA KEV)
Product
Samsung Mobile · Samsung Mobile Devices

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

Sources: unit42.paloaltonetworks.com · projectzero.google

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.