CVE-2026-21385

Overview

CVE-2026-21385 is a memory corruption vulnerability in Qualcomm chipset firmware. The flaw occurs due to improper use of alignment values during memory allocation, leading to an integer overflow (CWE-190) that can corrupt adjacent memory. A local attacker with low privileges can exploit this to achieve arbitrary code execution, full data disclosure, or a denial-of-service condition on the affected device.

Rapid KEV Listing: Evidence of Zero-Day Exploitation

This CVE achieved an exceptionally fast CISA KEV listing: published March 2, added to KEV March 3 (one day). This rapid timeline is a strong indicator of active, in-the-wild exploitation prior to public disclosure.

What This Likely Means

• Pre-disclosure exploitation phase: The vulnerability was likely discovered in the wild weeks or months before March 2, then reported through responsible disclosure channels (possibly Google TAG, Amnesty International Security Lab, or similar threat-intelligence groups).
• Coordinated embargo & disclosure: Qualcomm, Google (Android), and CISA coordinated the public release:
  • Qualcomm published the March 2026 Security Bulletin with patches
  • Google released the Android 2026-03-01 security patch simultaneously
  • CISA added the CVE to KEV on March 3 with evidence in hand
• Historical pattern: Qualcomm chipset vulnerabilities are frequently discovered in targeted surveillance/spyware campaigns (against journalists, activists, and dissidents). This exploit pattern mirrors previous zero-days like those in Pegasus.

Vulnerability Description

Memory corruption while using alignments for memory allocation.

The root cause is an integer overflow or wraparound (CWE-190) triggered when alignment parameters used during dynamic memory allocation are not properly validated. When a crafted alignment value causes the computed allocation size to wrap around, the allocator returns a buffer that is smaller than expected. Subsequent writes to this undersized buffer corrupt adjacent heap memory, which an attacker can leverage for code execution at the firmware or kernel level.

Affected Components

This vulnerability affects firmware across a massive range of Qualcomm chipsets spanning mobile, automotive, IoT, audio, connectivity, wearable, compute, and XR platforms. Over 230 distinct hardware configurations are listed in the NVD.

Snapdragon Mobile Platforms

Automotive & IoT

Connectivity & Modems

XR, Wearable & Compute

Audio Codecs & Amplifiers

Am I Affected? Consumer Guidance

With 230+ affected chipsets spanning nearly a decade of Qualcomm products, determining if your device is vulnerable can be challenging. Here's practical guidance by platform.

Samsung Galaxy Series

Google Pixel Phones

Apple iPhones & iPads

Windows Copilot+ PCs (Snapdragon X Elite Laptops)

How to Identify Your Chipset

How to Verify You're Patched

Quick Action Guide

1. Assume you're affected if you have any Qualcomm Snapdragon device from ~2017 onward.
2. Update immediately — Android: install all system updates until patch level reads 2026-03-01 or later. Windows ARM: run Windows Update and your OEM firmware tool.
3. Note: Some OEMs lag behind by weeks. Samsung, Google, and OnePlus typically patch quickly. Budget brands may take longer.
4. If no patch is available: Avoid untrusted apps, disable USB debugging, and restrict local access until updates arrive.

Impact

Mitigation & Remediation

Recommended Actions

1. Apply the Qualcomm March 2026 Security Bulletin patch — available from Qualcomm and distributed through OEM firmware updates.
2. Apply the Android March 2026 Security Patch Level (2026-03-01) — addresses this CVE for Android devices using affected Qualcomm SoCs.
3. Ensure all affected devices receive the latest firmware/baseband updates from their OEM.
4. Monitor CISA KEV Catalog for any updated guidance.
5. Restrict local access and enforce least-privilege policies on affected systems (automotive head units, IoT gateways, robotics platforms, etc.).