Security1 publisher3 min readPublished
Two critical image-decoder overflows anchor Samsung's 90-fix September Galaxy bulletin
Samsung lists 18 critical Google-side bugs plus 31 of its own, including heap overflows in DNG and JPEG decoding. The rollout starts with major flagships, so only the 2026-09-05 patch level tells a fleet owner who is actually covered.
The Watch · Security desk
What happened
- Samsung's September 2026 security bulletin lists fixes tied to 90 vulnerabilities, spanning Google's Android bulletin, Samsung Semiconductor software and Samsung's own components.
- Two Samsung-specific critical bugs, CVE-2026-21095 in DNG decoding and CVE-2026-21096 in JPEG decoding, are heap overflows Samsung says remote attackers can use to run arbitrary code.
- Samsung is issuing the release for major flagship models, with availability varying by device and by region.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The decoder overflows are exploitable by a remote attacker with no foothold, while the DualDAR pair needs an already privileged local attacker, so the critical label alone does not set the order in which these get shipped.
- decision With no exploitation indicated for the Samsung-specific flaws, fleet owners have to sequence on reachability rather than on evidence of attacks in progress.
- cost Reconciling the 90 against any given model is work that falls on whoever runs the fleet, because Samsung says some of those fixes may already have shipped in earlier maintenance releases.
Image decoders are the part of this package an attacker can reach without a foothold on the handset. CVE-2026-21095 is a critical heap-based buffer overflow in DNG decoding, CVE-2026-21096 the same class of bug in JPEG decoding [9][10], and Samsung's description of both is arbitrary code execution by a remote attacker [11]. The two DualDAR entries in the same bulletin also reach root, but only for a local attacker who already holds privileges, and only under certain conditions [14]. Both sets carry critical labels; the prerequisites differ, and the patch order follows the prerequisites. CVE-2026-21092, a path traversal in ImsService that lets a remote attacker create image files with system-server privileges [12], sits closer to the decoders than to DualDAR.
The count itself decomposes cleanly. Samsung lists 18 critical and 40 high-severity Google vulnerabilities [4], plus 31 SVEs and one high-severity Samsung Semiconductor issue on its own side [8]. That is 58 and 32, which is exactly the 90 in the headline figure [19]. So the total is Google's critical and high items plus Samsung's own list, with nothing below high counted from Google. August's release covered 56 Galaxy vulnerabilities including eight critical Android flaws [7]; September is 34 items larger and carries ten more critical Android entries [20].
On the Google side the worst item is defined by its prerequisites rather than its score: remote code execution through the System component, no additional execution privileges, no user interaction [5]. Samsung is issuing the release for major flagship models, with availability varying by device and region [3]. The per-device proof of Google coverage is the patch level string, 2026-09-05 or later [6]. Only that patch level, not the bulletin's September date, tells you whether a particular handset is actually covered. The 90 is also not a per-device delta, because Samsung notes that some SVE fixes listed in the bulletin may already have appeared in previous maintenance releases [2]. eSecurity Planet's guidance for organisations is mobile device management or unified endpoint management tracking of patch levels on Galaxy devices that reach corporate accounts or sensitive data [16]; for a single phone the check is Settings, Software update, Download and install [17].
Samsung's bulletin does not indicate that the Samsung-specific vulnerabilities it highlights are being actively exploited [15]. Ordering here follows reachability, ahead of any signal of active incidents. The four Smart Switch flaws Samsung patched recently, which could expose sensitive information or let nearby attackers impersonate devices [18], are the reminder that Samsung-maintained code generates its own defects on its own schedule, and the patch level that certifies Google's September bulletin covers Google's fixes; whether it also certifies Samsung's own list is a separate question Samsung leaves open.
What to watch
- Whether the September package reaches Galaxy models outside the major-flagship wave, and on what per-region schedule.
- Any exploitation report against the DNG or JPEG decoder overflows, which Samsung's bulletin currently does not indicate.
- October's bulletin size: a second consecutive package well above 56 items would make the August-to-September jump a trend rather than one heavy month.