CVE-2026-21385
Published: 02 March 2026
Description
Memory corruption while using alignments for memory allocation.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of known flaws like this memory corruption vulnerability in Qualcomm components.
Provides memory protection techniques such as ASLR and DEP to prevent exploitation of memory corruption from integer overflow in allocation alignments.
Enables detection of the presence of CVE-2026-21385 in the environment through vulnerability scanning, especially given its CISA KEV status.
Security SummaryAI
CVE-2026-21385 is a memory corruption vulnerability that occurs while using alignments for memory allocation, mapped to CWE-190 (Integer Overflow or Wraparound). It affects Qualcomm components, as documented in the Qualcomm March 2026 security bulletin, and is addressed in the Android security bulletin for March 1, 2026.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it with low attack complexity and no user interaction required, achieving high impacts on confidentiality, integrity, and availability within the affected component.
Qualcomm and Android security bulletins provide patches to mitigate the issue. The vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, indicating real-world exploitation.
Security practitioners should prioritize patching affected Qualcomm-based Android devices, given its presence in the CISA catalog.
Details
- CWE(s)
- KEV Date Added
- 03 March 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-privilege memory corruption vulnerability (integer overflow) enables exploitation for privilege escalation, matching T1068, with confirmed real-world exploitation per CISA KEV.