Static IV in AES-GCM Key Wrapping in Qualcomm Chipset

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Qualcomm, Inc.

Description

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-21383

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-323	Nonces should be used for the present occasion and only once.

Attack-Flow Graph

Executive Summary

This vulnerability is a cryptographic issue that occurs when a static initialization vector (IV) is used for AES-GCM key wrapping. AES-GCM requires a unique IV for each encryption operation to maintain security. Using a static IV compromises the security guarantees of AES-GCM.

Impact Analysis

The impact of this vulnerability is that it can lead to a compromise of confidentiality and integrity of the encrypted data. Since the IV is static, attackers may be able to decrypt or manipulate the wrapped keys, leading to potential unauthorized access or data breaches.

Hi! I’m here to help you understand CVE-2026-21383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70