CVE-2026-21385

Name: CVE-2026-21385
Creator: NVD / NIST
Published: 2026-03-02T17:16:29.207+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10Actively ExploitedEPSS 1.07%

Last modified Jun 17, 2026

CVE-2026-21385 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Memory corruption while using alignments for memory allocation.. CISA has confirmed active exploitation in the wild. EPSS estimates a 1.07% chance of exploitation in the next 30 days.

Description

Memory corruption while using alignments for memory allocation.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.07%

60.5th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Mar 24, 2026.

Weakness Enumeration

CWE-190

Affected Software

Vendor	Product	Versions
Qualcomm	Sm7675p Firmware	All versions
Qualcomm	Sm8475p Firmware	All versions
Qualcomm	Sm8550p Firmware	All versions
Qualcomm	Sm8635 Firmware	All versions
Qualcomm	Sm8635p Firmware	All versions
Qualcomm	Sm8650q Firmware	All versions
Qualcomm	Sm8750p Firmware	All versions
Qualcomm	Smart Audio 400 Platform Firmware	All versions
Qualcomm	Smart Display 200 Platform Firmware	All versions
Qualcomm	Snapdragon 4 Gen 1 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 4 Gen 2 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 429 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 460 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 480\+ 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 480 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 6 Gen 1 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 6 Gen 3 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 6 Gen 4 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 625 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 626 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 660 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 662 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 680 4g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 685 4g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 690 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 695 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 7\+ Gen 2 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 7 Gen 1 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 778g\+ 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 778g 5g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 782g Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 7c\+ Gen 3 Compute Firmware	All versions
Qualcomm	Snapdragon 7s Gen 3 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 8\+ Gen 1 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 8\+ Gen 2 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 8 Elite Firmware	All versions
Qualcomm	Snapdragon 8 Elite Gen 5 Firmware	All versions
Qualcomm	Snapdragon 8 Gen 1 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 8 Gen 2 Mobile Platform Firmware	All versions
Qualcomm	Snapdragon 8 Gen 3 Mobile Platform Firmware	All versions
Qualcomm	5g Fixed Wireless Access Platform Firmware	All versions
Qualcomm	Apq8098 Firmware	All versions
Qualcomm	Ar8031 Firmware	All versions
Qualcomm	Ar8035 Firmware	All versions
Qualcomm	C-V2x 9150 Firmware	All versions
Qualcomm	Csra6620 Firmware	All versions
Qualcomm	Csra6640 Firmware	All versions
Qualcomm	Fastconnect 6200 Firmware	All versions
Qualcomm	Fastconnect 6700 Firmware	All versions
Qualcomm	Fastconnect 6800 Firmware	All versions

Showing 50 of 237 affected configurations. See NVD for the full list.

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.htmlPatch, Vendor Advisory
https://source.android.com/docs/security/bulletin/2026/2026-03-01Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385US Government Resource

Timeline

Published: Mar 2, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-21385?

Memory corruption while using alignments for memory allocation.

How severe is CVE-2026-21385?

CVE-2026-21385 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 1.07% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2026-21385?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-21385?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST