Quick answers
- Is CVE-2026-21368 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-21368 being exploited in the wild.
- How severe is CVE-2026-21368?
- Medium severity, with a CVSS score of 5.3, published 6 July 2026.
- Which products and versions are affected?
- Qualcomm, Inc. Snapdragon FastConnect 6700, 6900, 7800; G3x Gen 2; IQ9 Series; SA7255P, SA8255P, SA8770P, SD 8 Gen1 5G, and others.
- Is there a fix for CVE-2026-21368?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-21368 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-21368?
- Check whether you run Qualcomm Fastconnect 6700, Qualcomm Fastconnect 6900, Qualcomm Fastconnect 7800 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds write (CWE-787) exists in Qualcomm Snapdragon firmware during the parsing of JPEG commands. The vulnerability is caused by unaccounted extra writes to a buffer during validation checks, leading to memory corruption. This is a local attack requiring low privileges, though it has high complexity (AC:H). Successful exploitation allows an attacker to impact the integrity, confidentiality, and availability of the system, potentially crossing security boundaries (Scope: Changed). Affected chipsets include various Snapdragon Mobile, Auto, and Compute platforms.
Affected products
- Qualcomm, Inc. Snapdragon FastConnect 6700, 6900, 7800; G3x Gen 2; IQ9 Series; SA7255P, SA8255P, SA8770P, SD 8 Gen1 5G, and others
Timeline
- 2026-07-06: advisory: Initial disclosure by Qualcomm and NVD publication.