Memory Corruption in Qualcomm Power Management via Buffer Overflow

Publication date: 2026-04-06

Last updated on: 2026-04-08

Assigner: Qualcomm, Inc.

Description

Memory Corruption when handling power management requests with improperly sized input/output buffers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-06

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2026-04-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21382

EUVD

EUVD-2026-19339

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	cologne_firmware	*
qualcomm	fastconnect_6900_firmware	*
qualcomm	fastconnect_7800_firmware	*
qualcomm	qca0000_firmware	*
qualcomm	sc8380xp_firmware	*
qualcomm	wcd9378c_firmware	*
qualcomm	wcd9380_firmware	*
qualcomm	wcd9385_firmware	*
qualcomm	wsa8840_firmware	*
qualcomm	wsa8845_firmware	*
qualcomm	wsa8845h_firmware	*
qualcomm	x2000077_firmware	*
qualcomm	x2000086_firmware	*
qualcomm	x2000090_firmware	*
qualcomm	x2000092_firmware	*
qualcomm	x2000094_firmware	*
qualcomm	xg101002_firmware	*
qualcomm	xg101032_firmware	*
qualcomm	xg101039_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves memory corruption that occurs when power management requests are handled with input or output buffers that are improperly sized.

Impact Analysis

The vulnerability can lead to serious impacts including high confidentiality, integrity, and availability risks, as indicated by its CVSS score. Exploiting this memory corruption could allow an attacker with limited privileges and local access to cause significant damage or unauthorized access.

Hi! I’m here to help you understand CVE-2026-21382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70