Memory Corruption via IOCTL Buffer Overflow in Qualcomm Drivers

Publication date: 2026-04-06

Last updated on: 2026-04-08

Assigner: Qualcomm, Inc.

Description

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-06

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2026-04-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21372

EUVD

EUVD-2026-19323

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	cologne_firmware	*
qualcomm	fastconnect_6700_firmware	*
qualcomm	fastconnect_6900_firmware	*
qualcomm	fastconnect_7800_firmware	*
qualcomm	qcm5430_firmware	*
qualcomm	qcm6490_firmware	*
qualcomm	video_collaboration_vc3_platform_firmware	*
qualcomm	snapdragon_460_mobile_platform_firmware	*
qualcomm	snapdragon_662_mobile_platform_firmware	*
qualcomm	snapdragon_7c+_gen_3_compute_firmware	*
qualcomm	wcd9370_firmware	*
qualcomm	wcd9375_firmware	*
qualcomm	wcd9378c_firmware	*
qualcomm	wcd9380_firmware	*
qualcomm	wcd9385_firmware	*
qualcomm	wcn3950_firmware	*
qualcomm	wcn3988_firmware	*
qualcomm	wsa8840_firmware	*
qualcomm	wsa8845_firmware	*
qualcomm	wsa8845h_firmware	*
qualcomm	x2000077_firmware	*
qualcomm	x2000086_firmware	*
qualcomm	x2000090_firmware	*
qualcomm	x2000092_firmware	*
qualcomm	x2000094_firmware	*
qualcomm	xg101002_firmware	*
qualcomm	xg101032_firmware	*
qualcomm	xg101039_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability involves memory corruption that occurs when IOCTL requests are sent with invalid buffer sizes during memcpy operations.

Impact Analysis

The vulnerability can lead to serious impacts including high confidentiality, integrity, and availability risks, as indicated by the CVSS score. Exploiting this memory corruption could allow an attacker with low privileges and local access to compromise the system.

Hi! I’m here to help you understand CVE-2026-21372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70