CVE-2026-21375
Published: 06 April 2026
Summary
CVE-2026-21375 is a high-severity Buffer Over-read (CWE-126) vulnerability in Qualcomm Cologne Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of buffer size parameters provided as inputs during IOCTL processing to prevent memory corruption from invalid buffer accesses.
Implements memory protection mechanisms such as address space layout randomization and writable-executable memory separation to prevent exploitation of memory corruption vulnerabilities like buffer size mishandling.
Mandates identification, reporting, and correction of specific flaws such as the unvalidated output buffer access in Qualcomm software components, as referenced in the vendor security bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption in IOCTL handler directly enables privilege escalation via exploitation of the driver vulnerability.
NVD Description
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Deeper analysisAI
CVE-2026-21375 is a memory corruption vulnerability classified under CWE-126, caused by accessing an output buffer without validating its size during IOCTL processing. It affects Qualcomm software components, as documented in the vendor's April 2026 security bulletin.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it through low-complexity attacks requiring no user interaction, potentially resulting in high impacts to confidentiality, integrity, and availability.
Mitigation guidance is provided in the Qualcomm April 2026 security bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html.
Details
- CWE(s)