CVE-2026-21367
Published: 06 April 2026
Summary
CVE-2026-21367 is a high-severity Buffer Over-read (CWE-126) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the buffer over-read vulnerability by remediating the flaw in processing nonstandard FILS Discovery Frames as specified in the Qualcomm April 2026 security bulletin.
Requires validation of frame action sizes during wireless initial scans to prevent buffer over-reads from out-of-range values in FILS Discovery Frames.
Implements memory protections that mitigate the effects of buffer over-reads triggered by malformed FILS Discovery Frames in the wireless stack.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer over-read in Wi-Fi FILS frame processing directly enables crafted network frames to crash the target (Endpoint DoS via vulnerability exploitation).
NVD Description
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
Deeper analysisAI
CVE-2026-21367 is a vulnerability that triggers a transient denial-of-service (DoS) condition when processing nonstandard FILS Discovery Frames containing out-of-range action sizes during initial scans. The issue stems from CWE-126 (Buffer Over-read) and affects Qualcomm products, as documented in their security bulletin.
Exploitation is possible over the network (AV:N) but demands high attack complexity (AC:H), high privileges (PR:H), and user interaction (UI:R). A successful attack changes scope (S:C) and achieves high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS 3.1 score of 7.6.
Mitigation details are provided in the Qualcomm April 2026 security bulletin available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html.
Details
- CWE(s)