CVE-2026-21385
Published: 02 March 2026
Summary
CVE-2026-21385 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Qualcomm Sm7675P Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 45.4th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of known flaws like this memory corruption vulnerability in Qualcomm components.
Provides memory protection techniques such as ASLR and DEP to prevent exploitation of memory corruption from integer overflow in allocation alignments.
Enables detection of the presence of CVE-2026-21385 in the environment through vulnerability scanning, especially given its CISA KEV status.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-privilege memory corruption vulnerability (integer overflow) enables exploitation for privilege escalation, matching T1068, with confirmed real-world exploitation per CISA KEV.
NVD Description
Memory corruption while using alignments for memory allocation.
Deeper analysisAI
CVE-2026-21385 is a memory corruption vulnerability that occurs while using alignments for memory allocation, mapped to CWE-190 (Integer Overflow or Wraparound). It affects Qualcomm components, as documented in the Qualcomm March 2026 security bulletin, and is addressed in the Android security bulletin for March 1, 2026.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it with low attack complexity and no user interaction required, achieving high impacts on confidentiality, integrity, and availability within the affected component.
Qualcomm and Android security bulletins provide patches to mitigate the issue. The vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, indicating real-world exploitation.
Security practitioners should prioritize patching affected Qualcomm-based Android devices, given its presence in the CISA catalog.
Details
- CWE(s)
- KEV Date Added
- 03 March 2026