Samsung's September Security Update Patches 90 Vulnerabilities Across Galaxy Devices
SMR Sep-2026 Release 1 fixes two critical image decoder flaws found by Google Project Zero that a crafted image could trigger without any user action.
Samsung released its September 2026 security update, SMR Sep-2026 Release 1, on September 8. It fixes 90 vulnerabilities across Galaxy phones, tablets and smartwatches, and rollout began on the Galaxy Z Fold 8 and Z Fold 8 Ultra in South Korea before expanding to other markets (Notebookcheck).
Where the 90 fixes come from
Most of the patch, 58 issues, comes from Android framework CVEs that Samsung incorporates from Google's monthly Android security release; reports put 18 of those at critical and 40 at high severity. Samsung also fixed 31 of its own vulnerabilities, known as SVEs, plus one high-risk issue from its Exynos chip division.
| Source of fixes | Count |
|---|---|
| Android (from Google's bulletin) | 58 (18 critical, 40 high, as reported) |
| Samsung-specific (SVE) | 31 |
| Exynos | 1 (high) |
| Total | 90 |
The two image decoder flaws
The two Samsung-specific fixes that matter most are heap-based buffer overflows in the DNG and JPEG decoders of libimagecodec.quram.so, the library Samsung uses to process images. They are tracked as SVE-2026-3247 and SVE-2026-3282, or CVE-2026-21095 and CVE-2026-21096, and affect Android 14, 15, 16 and 17. Each has a CVSS score of 9.2, with a vector that requires no privileges and no user interaction, so a malicious image could trigger them without the user opening anything unusual (OpenCVE, Lutra Security).
Brendon Tiszka and Mateusz Jurczyk of Google Project Zero found both flaws, and Samsung credits them in its bulletin. Both were privately disclosed, and there are no reports of attacks. Security tracker Action1 also lists a third critical issue, CVE-2026-21102, a use-after-free in DualDAR rated 9.3 that allows local root-level code execution (Action1).
What is affected and what to check
The patch covers Samsung's current lineup, from flagship foldables to more affordable models. In India, the Galaxy A57 has begun receiving it as firmware A576BXXS6AZI3, alongside Bangladesh and Nepal. That update carries only the security patch, not One UI 9.0, and is close to 500MB.
Samsung has not published a single rollout timeline, and Android patches usually stagger by model, carrier and region over several weeks. To check, open Settings, then Software Update. Devices without SMR Sep-2026 Release 1 remain exposed to the decoder flaws.
Why the volume matters
A 90-fix bulletin is on the high end even for Samsung, and the split between inherited Android fixes and Samsung's own SVEs shows how every Android maker patches two layers at once: the shared Android base and its own customisations.
What to watch next
No exploitation has been reported, but decoder bugs and critical Android CVEs tend to draw attention once a patch reveals what was broken. Install the update as soon as it appears.
