CVE-2026-21385 Qualcomm Multiple Chipsets Memory Corruption
An integer overflow in Qualcomm Snapdragon graphics drivers allows memory corruption, potentially enabling code execution or privilege escalation on Android devices.
- Exploited in the wild
- Since 3 Mar 2026
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21385?
CVE-2026-21385 is a high-severity vulnerability in Qualcomm Apq8098 Firmware, published on 2 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption while using alignments for memory allocation.
Weakness: CWE-190
Which versions are affected by CVE-2026-21385?
It affects 237 products.
Products include Qualcomm 5g Fixed Wireless Access Platform Firmware, Qualcomm Apq8098 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware, Qualcomm C-V2x 9150 Firmware, Qualcomm Csra6620 Firmware and 231 more.
How do I fix CVE-2026-21385?
Apply the vendor's patch. US federal agencies must fix it by 24 Mar 2026.
Is CVE-2026-21385 being exploited?
Yes. Attackers have exploited CVE-2026-21385 in the wild since at least 3 Mar 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Qualcomm Apq8098 Firmware
Sources
Also known as 4387106, A-478214401, ASB-A-478214401, GHSA-wwwq-962j-m7x8.