This material is best reviewed by Offensive Security Engineers, Vulnerability Researchers, and Mobile Product Security Architects. These specialists possess the requisite knowledge of heap memory management, protocol serialization (Protobuf), and low-level image parsing frameworks necessary to act on the technical findings presented.

Executive Summary: Analysis of the DNGerousLINK 0-Click Exploit Chains

Abstract: This technical briefing deconstructs a sophisticated 0-click exploit chain targeting WhatsApp on iOS and Samsung devices, initially observed in-the-wild in 2025. The research identifies a critical two-stage attack: a logic flaw in WhatsApp’s "Linked Devices" protocol (CVE-2025-55177) used to bypass user interaction, and a subsequent memory corruption vulnerability in the DNG (Digital Negative) image parsing frameworks of iOS (CVE-2025-43300) and Samsung’s proprietary libimagecodec_qram. The presentation details the reconstruction of these exploits, the discovery of multiple 0-day vulnerabilities in Samsung’s image libraries during the investigation, and the persistent lack of robust hardware-backed mitigations (PAC, MTE) in third-party mobile applications.

Technical Breakdown and Key Takeaways:

• 0:22 Historical Context of 0-Click Attacks: Nation-state actors continue to prioritize "Super Apps" (WhatsApp, iMessage) for remote compromise. Recent milestones include the 2019 WhatsApp VoIP stack bug, 2021's "Forced Entry" (PDF), and 2024's "BlastPass" (WebP).
• 2:21 iOS ImageIO Analysis (CVE-2025-43300): Analysis of the Apple patch in iOS 18.6.2 reveals significant changes in the RawCamera bundle. The vulnerability resides in the DNG (Digital Negative) decompression logic, specifically the Lossless JPEG unpacker.
• 8:06 Root Cause of iOS DNG Bug: The vulnerability is an out-of-bounds (OOB) write. The unpacker allocates a buffer based on width * height * samples_per_pixel but utilizes a hardcoded loop limit of width * 2 rather than checking the actual num_components. This allows a malicious DNG with num_components = 1 to trigger an overflow.
• 11:04 WhatsApp Entry Point (CVE-2025-55177): The 0-click vector exploits WhatsApp’s "Linked Devices" synchronization. Attackers forge a pair-data-operation-request (Protobuf type 16), which is white-listed for processing even from non-contacts.
• 15:53 Interaction-less URL Fetching: Because the WhatsApp web client cannot generate thumbnails locally, it sends a request to the mobile "Linked Device" to fetch and parse a URL. The mobile client performs this fetch and image parsing automatically in the background without user notification.
• 18:55 Forging End-to-End Encrypted Requests: Since messages are end-to-end encrypted, WhatsApp servers cannot inspect the payload. Attackers can forge the pair-device protocol message, forcing the victim's device to fetch a malicious DNG from an attacker-controlled URL.
• 24:28 Samsung Vulnerability (CVE-2025-21043): Similar to iOS, Samsung utilizes a proprietary library, libimagecodec_qram, for DNG parsing. While initially appearing to be a simple integer overflow patch, the vulnerability was being exploited in-the-wild to target Samsung users.
• 34:01 Discovery of New Samsung 0-Days: During reproduction attempts, researchers identified a new heap OOB access vulnerability in QRAM_DNG_Stream_get_data. A 32-bit integer overflow in the offset tracker results in a negative memory copy when processing files larger than 2GB.
• 37:08 OpCode Vulnerabilities: A second 0-day was discovered in the fix_bad_pixels_constant DNG OpCode. The research suggests that Samsung's image parsing surface remains highly vulnerable due to "subtle" patches and high code complexity.
• 41:43 The IP Service Vector: On Samsung devices, the IP Service (used for AI-related image analysis) periodically scans stored images. This service automatically parses DNG files, providing a persistent background execution vector for compromised files.
• 47:34 State of Mitigations: Despite the evolution of mobile security, third-party apps like WhatsApp often lack OS-level protections like Pointer Authentication Codes (PAC), Branch Target Identification (BTI), and Control Flow Integrity (CFI). Memory Tagging Extension (MTE) deployment remains too limited to stop contemporary 0-click chains.