CVE-2026-21379: Qualcomm Snapdragon memory corruption in memory allocation

CVE-2026-21379 · Severity: high · CVSS 7.8 · Published 2026-07-06

A security vulnerability exists in various Qualcomm Snapdragon processors and components used in laptops, mobile devices, and industrial IoT equipment. An attacker with local access to a device could exploit this flaw to corrupt system memory, potentially leading to a full system takeover or the theft of sensitive information. This affects the core hardware responsible for processing data and managing wireless connections.

Technologies: Qualcomm Snapdragon Compute, Qualcomm Snapdragon Industrial IOT, Qualcomm Video Collaboration Vc3 Platform. Vendors: Qualcomm.

Quick answers

Is CVE-2026-21379 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-21379 being exploited in the wild.
How severe is CVE-2026-21379?
High severity, with a CVSS score of 7.8, published 6 July 2026.
Which products and versions are affected?
Qualcomm Snapdragon Compute AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, IQX7181, QCA0000, QCA6391, QCA6420, QCA6430, QCM5430, QCM6490, SC8380XP, Snapdragon 7c+ Gen 3, Snapdragon 8c, Snapdragon 8cx, Snapdragon 8cx Gen 2, Snapdragon 8cx Gen 3; Qualcomm Snapdragon Industrial IOT WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835; Qualcomm Video Collaboration Vc3 Platform Affected.
Is there a fix for CVE-2026-21379?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21379 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-21379?
Check whether you run Qualcomm Snapdragon Compute, Qualcomm Snapdragon Industrial IOT or Qualcomm Video Collaboration Vc3 Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in multiple Qualcomm Snapdragon chipsets, including Compute and Industrial IOT platforms, due to improper validation of memory allocation sizes. Specifically, the system fails to correctly handle allocation requests that exceed maximum allowed values, leading to a buffer over-read (CWE-126) or related memory corruption. The attack vector is local, requiring low privileges and no user interaction. Successful exploitation can result in a total impact on confidentiality, integrity, and availability. A fix is available via the Qualcomm July 2026 security bulletin.

Affected products

  • Qualcomm, Inc. Snapdragon Compute AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, IQX7181, QCA0000, QCA6391, QCA6420, QCA6430, QCM5430, QCM6490, SC8380XP, Snapdragon 7c+ Gen 3, Snapdragon 8c, Snapdragon 8cx, Snapdragon 8cx Gen 2, Snapdragon 8cx Gen 3
  • Qualcomm, Inc. Snapdragon Industrial IOT WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835
  • Qualcomm, Inc. Qualcomm Video Collaboration VC3 Platform Affected

Timeline

  • 2026-07-06: advisory: Qualcomm published the security bulletin and NVD record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.