4 ms·
Android has an image processing library. Samsung added support for some weird image formats by a Korean company. That is the vulnerable code. The Samsung messag
by the_pwner224 6y ago
Android has an image processing library. Samsung added support for some weird image formats by a Korean company. That is the vulnerable code. The Samsung messages app automatically downloads MMS attachments and processes them. So send weird image format via SMS => RCE.
It has been patched in the latest update.
The Twitter thread says that disabling MMS auto download in the messaging app [or using another MMS app?] should probably fix the 0-click aspect of it, but would still leave open other channels of exploitation.
- wegs 6y agoI have a Samsung phone. It doesn't seem to have an option to automatically disable MMS downloads, and last patch is from March. I'm wondering if I'm vulnerable.