Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-21385

CVE-2026-21385HIGH

Qualcomm, Inc. Snapdragon — Integer Overflow or Wraparound in Graphics

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0126   68.7   YES

AFFECTED
  Product     Versions                             Fixed
  Snapdragon  5G Fixed Wireless Access Platform –  —

TIMELINE
  Dec 17  Reserved by qualcomm
  Mar 2   Published (CNA: qualcomm)
  Mar 3   Added to CISA KEV, remediation due 2026-03-24

CWE-190 · CNA: qualcomm · CVSS v3.1 · 3 references · KEV due March 24, 2026

Description

Memory corruption while using alignments for memory allocation.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 17, 2025	Reserved	Reserved by qualcomm
March 2, 2026	Published	Published (CNA: qualcomm)
March 3, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-03-24

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Qualcomm, Inc.	Snapdragon	—	5G Fixed Wireless Access Platform	—

Weaknesses

CWE-190

References (3)

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html
https://source.android.com/docs/security/bulletin/2026/2026-03-01 [third-party-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385 [government-resource]

Authoritative record: CVE-2026-21385 at cve.org

Vendors: qualcomm

Weaknesses: CWE-190

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-21385 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.