{"id":"CVE-2026-21385","kind":"vulnerability","aliases":["CVE-2026-21385"],"related":[],"title":"Memory corruption while using alignments for memory allocation","description":"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have a memory corruption bug triggered by how memory is allocated with alignment. CISA reports it is actively exploited, and the sources do not say what an attacker gets beyond memory corruption.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-03-03T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7675p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8475p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8550p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8635p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8650q firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm8750p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm smart audio 400 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm smart display 200 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 4 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 4 gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 429 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 460 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480\\+ 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 480 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 6 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 6 gen 3 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 6 gen 4 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 625 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 626 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 660 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 662 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 680 4g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 685 4g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 690 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 695 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7\\+ gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g\\+ 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 778g 5g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 782g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7c\\+ gen 3 compute firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 7s gen 3 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8\\+ gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8\\+ gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 elite firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 elite gen 5 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 3 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations in the vendor's Qualcomm security bulletin, as CISA directs; the sources do not name a patched version or setting.","status":"open","published_at":"2026-03-02T17:16:29+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:39:15+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:39:15Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in the vendor's Qualcomm security bulletin, as CISA directs; the sources do not name a patched version or setting.","reach":"unknown","summary":"Multiple Qualcomm chipsets have a memory corruption bug triggered by how memory is allocated with alignment. CISA reports it is actively exploited, and the sources do not say what an attacker gets beyond memory corruption.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory corruption in affected chipset code, with actively exploited attacks reported; exact impact unknown.","analyst_note":"Find the Qualcomm security bulletin for CVE-2026-21385 for affected chipsets, patched firmware or Android patch level, and exploit details; check the CISA KEV entry for the due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000445,"input_tokens":2536,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':340C '-2026':10A,13A '-21385':11A,14A '1':55A,97A,181A,224A,252A '2':63A,173A,232A,260A '200':48A '22':339C '3':105A,209A,216A,268A '4':53A,61A,113A '400':42A '429':69A '460':75A '480':81A,88A '4g':144A,151A '5':246A '5g':82A,89A,158A,165A,188A,195A '6':95A,103A,111A '625':119A '626':125A '660':131A '662':137A '680':143A '685':150A '690':157A '695':164A '7':171A,179A '778g':187A,194A '782g':201A '7c':207A '7s':214A '8':222A,230A,238A,243A,250A,258A,266A 'action':330C 'activ':299B 'align':5A,294B,324C 'alloc':8A,292B,327C 'android':272B 'appli':331C 'applic':337C 'attack':309B 'audio':41A 'beyond':311B 'bod':338C 'bug':286B 'chipset':281B,316C 'chipsets':17A 'cisa':295B,328C 'cloud':343C 'compute':210A 'contain':317C 'corrupt':2A,285B,313B,320C 'cve':9A,12A 'devic':277B 'discontinu':346C 'display':47A 'elite':239A,244A 'exploit':273B,300B 'firmware':20A,23A,26A,29A,32A,35A,38A,44A,50A,58A,66A,72A,78A,85A,92A,100A,108A,116A,122A,128A,134A,140A,147A,154A,161A,168A,176A,184A,191A,198A,204A,211A,219A,227A,235A,240A,247A,255A,263A,271A 'follow':336C 'gen':54A,62A,96A,104A,112A,172A,180A,208A,215A,223A,231A,245A,251A,259A,267A 'get':310B 'guidanc':341C 'infrastructur':274B 'instruct':335C 'memori':1A,7A,284B,290B,312B,319C,326C 'mitig':332C,352C 'mobil':276B 'mobile':56A,64A,70A,76A,83A,90A,98A,106A,114A,120A,126A,132A,138A,145A,152A,159A,166A,174A,182A,189A,196A,202A,217A,225A,233A,253A,261A,269A 'mobile-devic':275B 'multipl':279B,314C 'multiple':16A 'per':333C 'platform':43A,49A,57A,65A,71A,77A,84A,91A,99A,107A,115A,121A,127A,133A,139A,146A,153A,160A,167A,175A,183A,190A,197A,203A,218A,226A,234A,254A,262A,270A 'product':350C 'qualcomm':15A,18A,21A,24A,27A,30A,33A,36A,39A,45A,51A,59A,67A,73A,79A,86A,93A,101A,109A,117A,123A,129A,135A,141A,148A,155A,162A,169A,177A,185A,192A,199A,205A,212A,220A,228A,236A,241A,248A,256A,264A,278B,280B,315C 'report':296B 'requir':329C 'say':306B 'servic':344C 'sm7675p':19A 'sm8475p':22A 'sm8550p':25A 'sm8635':28A 'sm8635p':31A 'sm8650q':34A 'sm8750p':37A 'smart':40A,46A 'snapdragon':52A,60A,68A,74A,80A,87A,94A,102A,110A,118A,124A,130A,136A,142A,149A,156A,163A,170A,178A,186A,193A,200A,206A,213A,221A,229A,237A,242A,249A,257A,265A 'sourc':303B 'trigger':287B 'unavail':354C 'use':4A,323C,347C 'vendor':334C 'vulner':321C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-02T17:16:29+00:00","kev":{"dateAdded":"2026-03-03","dueDate":"2026-03-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-21385","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385","severity":null,"published_at":"2026-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21385","severity":null,"published_at":"2026-03-02T17:16:29+00:00","modified_at":"2026-06-17T10:18:36+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}