CVE-2026-21385
HIGHCVSS 7.8/10Actively ExploitedEPSS 1.07%
Last modified
CVE-2026-21385 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Memory corruption while using alignments for memory allocation.. CISA has confirmed active exploitation in the wild. EPSS estimates a 1.07% chance of exploitation in the next 30 days.
Description
Memory corruption while using alignments for memory allocation.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Sm7675p Firmware | All versions |
| Qualcomm | Sm8475p Firmware | All versions |
| Qualcomm | Sm8550p Firmware | All versions |
| Qualcomm | Sm8635 Firmware | All versions |
| Qualcomm | Sm8635p Firmware | All versions |
| Qualcomm | Sm8650q Firmware | All versions |
| Qualcomm | Sm8750p Firmware | All versions |
| Qualcomm | Smart Audio 400 Platform Firmware | All versions |
| Qualcomm | Smart Display 200 Platform Firmware | All versions |
| Qualcomm | Snapdragon 4 Gen 1 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 4 Gen 2 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 429 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 460 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 480\+ 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 480 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 6 Gen 1 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 6 Gen 3 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 6 Gen 4 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 625 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 626 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 660 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 662 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 680 4g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 685 4g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 690 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 695 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 7\+ Gen 2 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 7 Gen 1 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 778g\+ 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 778g 5g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 782g Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 7c\+ Gen 3 Compute Firmware | All versions |
| Qualcomm | Snapdragon 7s Gen 3 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 8\+ Gen 1 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 8\+ Gen 2 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 8 Elite Firmware | All versions |
| Qualcomm | Snapdragon 8 Elite Gen 5 Firmware | All versions |
| Qualcomm | Snapdragon 8 Gen 1 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 8 Gen 2 Mobile Platform Firmware | All versions |
| Qualcomm | Snapdragon 8 Gen 3 Mobile Platform Firmware | All versions |
| Qualcomm | 5g Fixed Wireless Access Platform Firmware | All versions |
| Qualcomm | Apq8098 Firmware | All versions |
| Qualcomm | Ar8031 Firmware | All versions |
| Qualcomm | Ar8035 Firmware | All versions |
| Qualcomm | C-V2x 9150 Firmware | All versions |
| Qualcomm | Csra6620 Firmware | All versions |
| Qualcomm | Csra6640 Firmware | All versions |
| Qualcomm | Fastconnect 6200 Firmware | All versions |
| Qualcomm | Fastconnect 6700 Firmware | All versions |
| Qualcomm | Fastconnect 6800 Firmware | All versions |
Showing 50 of 237 affected configurations. See NVD for the full list.
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-21385?
Memory corruption while using alignments for memory allocation.
How severe is CVE-2026-21385?
CVE-2026-21385 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 1.07% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2026-21385?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2138A vulnerability was found in Tenda TX9 up to 22.03.02.10_mul…8.8
- CVE-2026-21380Memory Corruption when using deprecated DMABUF IOCTL calls t…7.8
- CVE-2026-21381Transient DOS when receiving a service data frame with exces…7.5
- CVE-2026-21382Memory Corruption when handling power management requests wi…7.8
- CVE-2026-21383Cryptographic Issue when using a static initialization vecto…7.1
- CVE-2026-21384Memory Corruption when updating prepared commands with inval…5.3
- CVE-2026-21386Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.1…4.3
- CVE-2026-21387Protection mechanism failure for some Intel(R) LLM Library f…5.4
- CVE-2026-21388Mattermost Plugins versions <=2.3.1 fail to limit the reques…6.5
- CVE-2026-21389An OS command injection vulnerability exists in XWEB Pro ve…8.8
- CVE-2026-2139A vulnerability was determined in Tenda TX9 up to 22.03.02.1…8.8
- CVE-2026-21391An improper validation vulnerability exists within PingAM wh…9.5
Are you affected by CVE-2026-21385?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST