CVE-2026-21366: Qualcomm component memory corruption in packet processing

CVE-2026-21366 · Severity: high · CVSS 7.8 · Published 2026-08-04

A Qualcomm component processes network packets and fails to properly validate packet size when values approach the maximum allowed limit, leading to memory corruption. An attacker with network access could exploit this to crash the affected system or potentially execute arbitrary code, disrupting services or compromising device integrity.

Technologies: Qualcomm Qam8255p, Qualcomm Qam8255p Firmware, Qualcomm Qam8295p, Qualcomm Qam8295p Firmware, Qualcomm Qam8620p, Qualcomm Qam8620p Firmware, Qualcomm Qamsrv1h, Qualcomm Qamsrv1h Firmware, Qualcomm Qamsrv1m, Qualcomm Qamsrv1m Firmware, Qualcomm Qca6574au, Qualcomm Qca6574au Firmware, Qualcomm Qca6595, Qualcomm Qca6595 Firmware, Qualcomm Qca6595au, Qualcomm Qca6595au Firmware, Qualcomm Qca6688aq, Qualcomm Qca6688aq Firmware, Qualcomm Qca6696, Qualcomm Qca6696 Firmware, Qualcomm Qca6698aq, Qualcomm Qca6698aq Firmware, Qualcomm Qca6797aq, Qualcomm Qca6797aq Firmware, Qualcomm Qca8695au, Qualcomm Qca8695au Firmware, Qualcomm Sa6145p, Qualcomm Sa6145p Firmware, Qualcomm Sa6150p, Qualcomm Sa6150p Firmware, Qualcomm Sa6155p, Qualcomm Sa6155p Firmware, Qualcomm Sa7255p, Qualcomm Sa7255p Firmware, Qualcomm Sa7775p, Qualcomm Sa7775p Firmware, Qualcomm Sa8145p, Qualcomm Sa8145p Firmware, Qualcomm Sa8150p, Qualcomm Sa8150p Firmware, Qualcomm Sa8155p, Qualcomm Sa8155p Firmware, Qualcomm Sa8195p, Qualcomm Sa8195p Firmware, Qualcomm Sa8255p, Qualcomm Sa8255p Firmware, Qualcomm Sa8295p, Qualcomm Sa8295p Firmware, Qualcomm Sa8540p, Qualcomm Sa8540p Firmware, Qualcomm Sa8620p, Qualcomm Sa8620p Firmware, Qualcomm Sa8770p, Qualcomm Sa8770p Firmware, Qualcomm Sa9000p, Qualcomm Sa9000p Firmware, Qualcomm Srv1h, Qualcomm Srv1h Firmware, Qualcomm Srv1l, Qualcomm Srv1l Firmware, Qualcomm Srv1m, Qualcomm Srv1m Firmware. Vendors: Qualcomm.

Quick answers

Is CVE-2026-21366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-21366 being exploited in the wild.
How severe is CVE-2026-21366?
High severity, with a CVSS score of 7.8, published 4 August 2026.
Which products and versions are affected?
Qualcomm <UNKNOWN> <UNKNOWN>.
Is there a fix for CVE-2026-21366?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21366 attacked?
It is attacked over the network.
Am I affected by CVE-2026-21366?
Check whether you run Qualcomm Lemans Au Lgit, Qualcomm Lemans Au Lgit Firmware, Qualcomm Lemansau or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a memory corruption flaw in packet processing logic within a Qualcomm component. The root cause is insufficient validation of packet sizes when they reach near-maximum values, allowing an attacker to trigger out-of-bounds memory access. The attack vector is network-based and does not require authentication or user interaction. Successful exploitation can lead to denial of service or arbitrary code execution depending on memory layout and attacker capabilities. A patch is expected to be available from Qualcomm through their security bulletins.

Affected products

  • Qualcomm <UNKNOWN> <UNKNOWN>

Timeline

  • 2026-08-04: disclosed
  • 2026-08-04: advisory: Qualcomm security bulletin published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.