Summary
A high-severity memory corruption vulnerability known as CVE-2026-21385 affects Qualcomm graphics components in a variety of Snapdragon-powered mobile, automotive, IoT, compute, wearable, and connectivity systems. Memory corruption may result from an integer overflow or wraparound that occurs during memory allocation alignment. The vulnerability has been added to the Known Exploited Vulnerabilities (KEV) list by CISA after Google determined that it is being used in targeted, restricted attacks. For impacted devices, quick patching is crucial. Qualcomm fixed the problem in its March 2026 Security Bulletin, and Google included the repair in the March 2026 Android Security Bulletin.
Urgent Actions Required
- Apply the March 2026 OEM firmware or Android security updates that include Qualcomm's fix for CVE-2026-21385.
- Verify that affected Android devices are running security patch level 2026-03-05 or later where available.
- Identify Qualcomm-powered mobile, IoT, automotive, wearable, and compute devices that may still be using vulnerable firmware versions.
- Restrict installation of applications from untrusted sources and enforce Google Play Protect on managed Android devices until patching is complete.
- Monitor for signs of device instability, unexpected crashes, firmware resets, or abnormal behavior that could indicate exploitation attempts on unpatched systems.
Which Systems Are Vulnerable to CVE-2026-21385?
Technical Overview
- Vulnerability Type:Integer Overflow or Wraparound (CWE-190) Leading to Memory Corruption
-
Affected Software/Versions:
- Qualcomm Snapdragon Mobile platforms
- Snapdragon Auto platforms
- Snapdragon Compute platforms
- Snapdragon Connectivity platforms
- Snapdragon Consumer and Industrial IoT platforms
- Snapdragon Wearables
- Snapdragon Voice & Music platforms
- Qualcomm FastConnect, QCA, WCN, WCD, and WSA components
- Qualcomm Robotics, XR, AR, and Vision Intelligence platforms
-
CVSS Vector: v3.1
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-21385 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-21385?
Vulnerability Root Cause:
An integer overrun or wraparound (CWE-190) during memory allocation alignment in Qualcomm’s graphics component is the source of the vulnerability. Incorrect memory allocation may occur when alignment data are evaluated without enough validation. Memory corruption results from this, giving low-privilege, local attackers a chance to take over the compromised device.
How Can You Mitigate CVE-2026-21385?
If immediate patching is delayed or not possible:
- Block untrusted or sideloaded apps.
- Enable Google Play Protect.
- Enforce Android security patch level 2026-03-01 or later through MDM.
- Restrict access to unpatched Qualcomm-powered devices.
- Isolate or replace devices that no longer receive security updates.
Which Assets and Systems Are at Risk?
-
Asset Types Affected:
- Android Devices - Devices using affected Qualcomm graphics/display components
- Mobile Devices - Smartphones powered by vulnerable Qualcomm Snapdragon chipsets
- IoT Devices - Qualcomm-based IoT devices using affected firmware
- Automotive Platforms - Qualcomm-powered automotive systems running vulnerable components
-
Business-Critical Systems at Risk:
- Enterprise Mobile Fleets - Corporate-managed Android devices that have not received the March 2026 security updates
- BYOD Environments - Personally owned Android devices with vulnerable Qualcomm components
- Mobile and IoT Deployments - Organizations relying on Qualcomm-powered mobile or IoT devices for daily operations
-
Exposure Level:
- Unpatched Devices - Systems that have not received the March 2026 Qualcomm and Android security updates
- Devices Running Untrusted Apps - Increased risk where malicious or sideloaded applications can obtain local code execution
- Managed and Unmanaged Devices - Both enterprise-managed and unmanaged Qualcomm-powered devices remain at risk until patched
Will Patching CVE-2026-21385 Cause Downtime?
Patch application impact: Apply the OEM firmware update containing Qualcomm’s March 2026 fixes. Verify the device is running the 2026-03-05 Android security patch level or later.
Mitigation (if immediate patching is not possible): Restrict sideloaded apps, enforce Google Play Protect, require Android patch level 2026-03-01 or later through MDM, and isolate unsupported devices.
How Can You Detect CVE-2026-21385 Exploitation?
Indicators of Compromise (IOCs/IOAs):
- Unexpected kernel panics, firmware resets, or SubSystem Restart (SSR) events
- Crash dumps showing heap corruption in Qualcomm drivers or DSP/modem components
- Device instability after installation of untrusted or sideloaded applications
Behavioral Indicators:
- Repeated crashes involving Qualcomm-supplied modules
- Devices running security patch levels older than 2026-03-01
- Installation of applications from unknown or untrusted sources before abnormal device behavior
Alerting Strategy:
-
Priority: High
- Alert on devices missing the March 2026 Android security updates
- Monitor MDM compliance for outdated security patch levels
- Correlate Android crash reports for repeated faults in Qualcomm components
- Flag installation of untrusted applications on unpatched devices
Remediation & Response
-
Incident Response Considerations:
- Identify devices using affected Qualcomm components.
- Check MDM compliance for outdated Android security patch levels.
- Review Android crash reports for repeated faults in Qualcomm modules.
- Investigate unexpected kernel panics, firmware resets, or SubSystem Restart (SSR) events.
- Monitor installation of untrusted or sideloaded applications on unpatched devices.
Gain deep visibility across every endpoint
-
-
- Learn how Fidelis Endpoint® accelerates threat detection and response
- Explore remote investigation and response capabilities
- Discover how to reduce alert fatigue and improve analyst efficiency
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 7.8 | High-severity memory corruption vulnerability |
| Attack Vector | Local | Exploitation requires local access to the affected device |
| Attack Complexity | Low | No special conditions are required beyond local access |
| Privileges Required | Low | An attacker needs low-level privileges to exploit the flaw |
| Exploitation does not require user interaction | None | Exploitation does not require user interaction |
| Scope | Unchanged | The impact is limited to the vulnerable component |
| Confidentiality Impact | High | Successful exploitation may expose sensitive information |
| Integrity Impact | High | An attacker may modify or corrupt data |
| Availability Impact | High | Exploitation can affect normal device operation through memory corruption |
References:
