Back
CVE-2026-21385
Integer Overflow or Wraparound in Graphics
High7.8Known exploitedEPSS 1.3%
- Published
- Updated
- Reserved
- Assigned by
- qualcomm
Description
Memory corruption while using alignments for memory allocation.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Qualcomm Multiple Chipsets Memory Corruption Vulnerability.
- Added
- 3 Mar 2026
- Fix due (US federal)
- 24 Mar 2026
- Used by ransomware
- Not known
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| qualcommCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.3% · top 29% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected 5G Fixed Wireless Access Platform
- affected APQ8098
- affected AR8031
- affected AR8035
- affected C-V2X 9150
- affected CSRA6620
- affected CSRA6640
- affected FastConnect 6200
- affected FastConnect 6700
- affected FastConnect 6800
- affected FastConnect 6900
- affected FastConnect 7800
- affected Flight RB5 5G Platform
- affected FSM100 Platform
- affected G1 Gen 1
- affected G2 Gen 1
- affected IQ6 Series Platform
- affected IQ8 Series Platform
- affected IQ9 Series Platform
- affected LeMans_AU_LGIT
- affected LeMansAU
- affected MDM9250
- affected MDM9628
- affected Milos
- affected Monaco_IOT
- affected Netrani
- affected Orne
- affected Palawan25
- affected Pandeiro
- affected QAM8255P
- affected QAM8295P
- affected QAMSRV1H
- affected QAMSRV1M
- affected QCA2066
- affected QCA6174A
- affected QCA6391
- affected QCA6564A
- affected QCA6564AU
- affected QCA6574
- affected QCA6574A
- and 195 more
References (3)
- https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html (opens in a new tab)
- https://source.android.com/docs/security/bulletin/2026/2026-03-01 (opens in a new tab)third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-21385)Record last updated .