Cyber Posture

CVE-2026-21381

High

Published: 06 April 2026

Published
06 April 2026
Modified
08 April 2026
KEV Added
Patch
CVSS Score 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0003 9.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21381 is a high-severity Buffer Over-read (CWE-126) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the buffer over-read (CWE-126) by enforcing validation of service data frame lengths at NAN protocol input points to prevent processing of excessive length frames.

prevent

Provides comprehensive denial-of-service protection tailored to mitigate transient DoS triggered by malformed excessive-length NAN service data frames.

prevent

Memory protection mechanisms help mitigate the effects of buffer over-reads during NAN device matching frame processing, reducing crash likelihood.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer over-read in NAN protocol directly enables application/system exploitation for endpoint DoS (T1499.004).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

Deeper analysisAI

CVE-2026-21381 is a transient denial-of-service (DoS) vulnerability stemming from a buffer over-read (CWE-126) that occurs when receiving a service data frame with excessive length during device matching over a Neighborhood Awareness Network (NAN) protocol connection. It affects Qualcomm components, as detailed in their security bulletin.

Exploitation requires network access (AV:N), high attack complexity (AC:H), high privileges (PR:H), and user interaction (UI:R), with a scoped impact (S:C) leading to high confidentiality, integrity, and availability consequences (C:H/I:H/A:H), scoring 7.6 on CVSS 3.1. A privileged attacker could thus trigger the transient DoS, potentially disrupting device functionality during NAN-based peer discovery.

Qualcomm's April 2026 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2026-bulletin.html provides further details on affected products and recommended mitigations or patches.

Details

CWE(s)

Affected Products

qualcomm
ar8035 firmware
all versions
qualcomm
cologne firmware
all versions
qualcomm
fastconnect 6200 firmware
all versions
qualcomm
fastconnect 6700 firmware
all versions
qualcomm
fastconnect 6900 firmware
all versions
qualcomm
fastconnect 7800 firmware
all versions
qualcomm
fwa gen 3 ultra firmware
all versions
qualcomm
g2 gen 1 firmware
all versions
qualcomm
milos firmware
all versions
qualcomm
netrani firmware
all versions
+93 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-21367Same product: Qualcomm Ar8035
CVE-2025-59600Same product: Qualcomm Ar8035
CVE-2026-21378Same product: Qualcomm Cologne
CVE-2026-21374Same product: Qualcomm Cologne
CVE-2026-21376Same product: Qualcomm Cologne
CVE-2026-21373Same product: Qualcomm Cologne
CVE-2026-21375Same product: Qualcomm Cologne
CVE-2026-21371Same product: Qualcomm Cologne
CVE-2025-47390Same product: Qualcomm Cologne
CVE-2024-53027Same product: Qualcomm Ar8035

References