CVE-2020-8899: Memory corruption in Quram library when decoding qmg can lead to RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-05-06 · updated 2026-06-17
Weakness: CWE-122

Description

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.

Affected products

Android: 8.0, 8.1, 9.0, 10.0

References

http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.html
https://bugs.chromium.org/p/project-zero/issues/detail?id=2002
https://security.samsungmobile.com/securityUpdate.smsb
https://www.kb.cert.org/vuls/id/366027
http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.html
https://bugs.chromium.org/p/project-zero/issues/detail?id=2002
https://security.samsungmobile.com/securityUpdate.smsb
https://www.kb.cert.org/vuls/id/366027

Get alerted when CVE-2020-8899 or the next vulnerability affects your stack