CVE-2026-21385Integer Overflow or Wraparound in Graphics
- 7.8HighCVSS base score
- 1.3%Exploitation in 30 daysEPSS · top 29% of all CVEs
- YesKnown exploitedin CISA's KEV since 3 Mar 2026
- YesPublic exploitsa reference or SSVC says so
Description
Memory corruption while using alignments for memory allocation.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Qualcomm Multiple Chipsets Memory Corruption Vulnerability.
- Added
- 3 Mar 2026
- Fix due (US federal)
- 24 Mar 2026
- Used by ransomware
- Not known
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 3 Mar 2026.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.
Timeline
ID reserved
By qualcomm
- 3 months later
· 3 months later
Published
- 1 day later
· 1 day later
Added to CISA KEV
Known exploited in the wild
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| qualcommCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.3% · top 29% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 5G Fixed Wireless Access Platform
- affected APQ8098
- affected AR8031
- affected AR8035
- affected C-V2X 9150
- affected CSRA6620
- affected CSRA6640
- affected FastConnect 6200
- affected FastConnect 6700
- affected FastConnect 6800
- affected FastConnect 6900
- affected FastConnect 7800
- affected Flight RB5 5G Platform
- affected FSM100 Platform
- affected G1 Gen 1
- affected G2 Gen 1
- affected IQ6 Series Platform
- affected IQ8 Series Platform
- affected IQ9 Series Platform
- affected LeMans_AU_LGIT
- affected LeMansAU
- affected MDM9250
- affected MDM9628
- affected Milos
- affected Monaco_IOT
- affected Netrani
- affected Orne
- affected Palawan25
- affected Pandeiro
- affected QAM8255P
- affected QAM8295P
- affected QAMSRV1H
- affected QAMSRV1M
- affected QCA2066
- affected QCA6174A
- affected QCA6391
- affected QCA6564A
- affected QCA6564AU
- affected QCA6574
- affected QCA6574A
- and 195 more
References
References3
- https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html (opens in a new tab)
- https://source.android.com/docs/security/bulletin/2026/2026-03-01 (opens in a new tab)third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-9202 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-21385)Record last updated .