A critical vulnerability in the Monkey’s Audio (APE) decoder, affecting Samsung devices running Android 12, 13, and 14, including the S23 and S24 models, has been discovered by Google Project Zero researcher Natalie Silvanovich. The flaw, tracked as CVE-2024-49415 (CVSS score: 8.1/10), involves an out-of-bounds write in the “saped_rec” function within the libsaped.so library, where a specially crafted APE audio file can overflow a buffer allocated by the C2 media service. This zero-click exploit requires no user interaction and is particularly concerning for devices with Rich Communication Services (RCS) enabled in Google Messages, as the transcription service automatically decodes incoming audio messages before user interaction. Silvanovich highlighted the risk of adjacent non-DMA data being affected by the overflow, raising concerns about potential remote code execution (RCE). In a hypothetical attack, a malicious audio message could cause the media codec process to crash, and under certain conditions, allow an attacker to gain control of the device. Samsung addressed the issue by adding input validation in its December 2024 security update and urged users to install the latest patches. The same update also resolved another high-severity vulnerability (CVE-2024-49413, CVSS score: 7.1) in SmartSwitch, which could allow local attackers to install malicious apps through improper cryptographic signature verification. CTIX analysts recommend that Samsung users ensure they have the most up-to-date patch installed on their devices to prevent future exploitation.