A zero-day vulnerability in Samsung's Android image processing library allowed the deployment of LandFall spyware through malicious images sent via WhatsApp. This spyware targets specific Galaxy models and can record calls, track locations, and access personal data.

Samsung has addressed a critical remote code execution vulnerability (CVE-2025-21043) affecting Android devices running version 13 or later, which was exploited in zero-day attacks. Discovered in a closed-source image parsing library, the flaw allows attackers to execute malicious code remotely. Meta and WhatsApp reported the vulnerability, highlighting the importance of keeping devices updated to mitigate such risks.