CVE-2026-21385
Qualcomm Multiple Chipsets Memory Corruption Vulnerability
Description
CVE-2026-21385 is a high-severity memory corruption vulnerability in multiple Qualcomm chipsets caused by an integer overflow during memory allocation alignment calculations. With a CVSS v3.1 base score of 7.8 (HIGH) and a local attack vector requiring low privileges, the vulnerability allows an attacker to achieve full compromise of confidentiality, integrity, and availability on affected devices. CISA added CVE-2026-21385 to the Known Exploited Vulnerabilities catalog on March 3, 2026, with a remediation deadline of March 24, 2026. The EPSS score of 0.015% at the 3.1st percentile suggests limited but confirmed exploitation. No known ransomware association has been identified at this time.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | sm7675p firmware | - |
| qualcomm | sm8475p firmware | - |
| qualcomm | sm8550p firmware | - |
| qualcomm | sm8635 firmware | - |
| qualcomm | sm8635p firmware | - |
| qualcomm | sm8650q firmware | - |
| qualcomm | sm8750p firmware | - |
| qualcomm | smart audio 400 platform firmware | - |
| qualcomm | smart display 200 platform firmware | - |
| qualcomm | snapdragon 4 gen 1 mobile platform firmware | - |
| qualcomm | snapdragon 4 gen 2 mobile platform firmware | - |
| qualcomm | snapdragon 429 mobile platform firmware | - |
| qualcomm | snapdragon 460 mobile platform firmware | - |
| qualcomm | snapdragon 480\+ 5g mobile platform firmware | - |
| qualcomm | snapdragon 480 5g mobile platform firmware | - |
| qualcomm | snapdragon 6 gen 1 mobile platform firmware | - |
| qualcomm | snapdragon 6 gen 3 mobile platform firmware | - |
| qualcomm | snapdragon 6 gen 4 mobile platform firmware | - |
| qualcomm | snapdragon 625 mobile platform firmware | - |
| qualcomm | snapdragon 626 mobile platform firmware | - |
References
- https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html(Patch, Vendor Advisory)
- https://source.android.com/docs/security/bulletin/2026/2026-03-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
CVE-2026-21385 exploits an integer overflow vulnerability in how Qualcomm chipset firmware handles memory allocation alignments. An integer overflow occurs when an arithmetic operation produces a value exceeding the maximum representable value for the integer type, causing it to "wrap around" to a much smaller number. In this case, alignment calculations during memory allocation overflow, resulting in a critically undersized buffer being allocated. When subsequent operations write data to this buffer assuming the originally intended (larger) size, a heap-based buffer overflow occurs, corrupting adjacent memory and enabling arbitrary code execution.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
The impact of CVE-2026-21385 is significant across all three security dimensions. Confidentiality (High): Successful exploitation grants the attacker access to sensitive data stored in or processed by the affected chipset, including encryption keys, authentication tokens, and data from the baseband processor or trusted execution environment. Integrity (High): Memory corruption enables the attacker to modify code execution flow, inject malicious payloads, and alter system behavior at the firmware level, potentially persisting across device reboots. Availability (High): The vulnerability can be used to crash the affected subsystem or render the device inoperable through targeted memory corruption.
The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector (AV:L), meaning the attacker requires local access to the device or the ability to execute code locally, such as through a malicious application installed on an Android device. The low privilege requirement (PR:L) means the attacker needs basic user-level access, and no user interaction (UI:N) is required beyond running the malicious code. The unchanged scope (S:U) confines the impact to the affected chipset component, though this still represents full compromise of the device’s security context. Given the widespread deployment of Qualcomm chipsets across Android smartphones, tablets, and IoT devices, the potential blast radius of this vulnerability is substantial.
Exploit Maturity
CVE-2026-21385 has been confirmed as actively exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026. The KEV listing mandates federal agencies to remediate by March 24, 2026. Despite active exploitation, the EPSS score remains low at 0.015% (3.1st percentile), suggesting that exploitation is currently targeted and limited in scope rather than widespread. This pattern is common for chipset-level vulnerabilities that require specialized knowledge and device-specific exploitation techniques.
Qualcomm addressed the vulnerability in its March 2026 Security Bulletin, and Google included the fix in the Android Security Bulletin for March 2026. No known ransomware campaigns have been associated with this vulnerability. The combination of KEV listing and low EPSS suggests exploitation by sophisticated threat actors conducting targeted attacks rather than commodity malware operations.
Remediation
-
Apply the March 2026 Android Security Update to all affected devices as soon as possible. The patch is included in the Android security patch level 2026-03-01 or later, as documented in the Android Security Bulletin.
-
Review the Qualcomm Security Bulletin at Qualcomm March 2026 Bulletin to identify which specific chipsets in your device fleet are affected and verify patch availability from your device manufacturer.
-
Prioritize enterprise mobile device management (MDM) deployment of the security update across all managed Android devices. Configure MDM policies to enforce a maximum acceptable security patch level age and flag non-compliant devices.
-
Audit installed applications on affected devices to identify and remove potentially malicious apps that could serve as the local attack vector for exploitation. Restrict app installations to trusted sources and enforce Google Play Protect scanning.
-
Monitor for indicators of compromise on affected devices, including unexpected crashes of chipset-related services, abnormal memory usage patterns, and signs of privilege escalation. Implement network-level monitoring for unusual data exfiltration from mobile endpoints.
-
For devices no longer receiving security updates, consider device replacement or implement compensating controls such as restricting network access, limiting app installation capabilities, and isolating the device from sensitive enterprise resources.
Technical Details
CVE-2026-21385 is an integer overflow vulnerability in the memory allocation alignment logic of Qualcomm chipset firmware. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H breaks down as follows: Attack Vector (AV:L): Local access is required, typically achievable through a malicious application running on the target Android device. Attack Complexity (AC:L): No special conditions or race conditions need to be won. Privileges Required (PR:L): Basic user-level access is sufficient, such as an unprivileged Android application. User Interaction (UI:N): No user interaction is needed beyond installing or running the malicious app. Scope (S:U): Impact is confined to the vulnerable component. Impact: Confidentiality, Integrity, and Availability are all rated High.
The vulnerability lies in the alignment calculation performed during dynamic memory allocation within the chipset firmware. When memory is allocated with specific alignment constraints, the size calculation involves arithmetic operations on alignment values. If a crafted alignment parameter causes the size calculation to overflow the integer type, the resulting allocation size wraps around to a much smaller value than intended. The firmware then proceeds to write data into this undersized buffer based on the original, pre-overflow size, resulting in a heap-based buffer overflow. This overflow corrupts adjacent heap metadata and objects, which an attacker can leverage to achieve arbitrary read/write primitives and ultimately arbitrary code execution at the firmware privilege level.
Frequently Asked Questions
What is CVE-2026-21385?
CVE-2026-21385 is a high-severity (CVSS 7.8) memory corruption vulnerability affecting multiple Qualcomm chipsets. It is caused by an integer overflow in memory allocation alignment calculations, which can lead to heap-based buffer overflows and arbitrary code execution. The vulnerability is actively exploited and listed in CISA’s KEV catalog.
Which devices are affected by CVE-2026-21385?
Multiple Qualcomm chipsets are affected, spanning a wide range of Android smartphones, tablets, and other devices. Refer to the Qualcomm March 2026 Security Bulletin for the complete list of affected chipsets and the Android Security Bulletin for patch availability.
How can I protect my device from CVE-2026-21385?
Install the March 2026 Android security update (patch level 2026-03-01 or later) as soon as your device manufacturer makes it available. Avoid installing applications from untrusted sources, as exploitation requires local code execution. Enable Google Play Protect to detect potentially harmful applications.
Is CVE-2026-21385 used in ransomware attacks?
As of March 2026, no known ransomware campaigns have been associated with CVE-2026-21385. The vulnerability is classified as having an unknown ransomware association. However, active exploitation has been confirmed, and organizations should prioritize patching regardless of the ransomware status.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.