Is CVE-2026-21384 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21384 being exploited in the wild.

How severe is CVE-2026-21384?

Medium severity, with a CVSS score of 5.3, published 6 July 2026.

Which products and versions are affected?

Qualcomm, Inc. Snapdragon Auto; Qualcomm, Inc. Snapdragon Compute; Qualcomm, Inc. Snapdragon Consumer IOT; Qualcomm, Inc. Snapdragon Industrial IOT; and 4 more.

Is there a fix for CVE-2026-21384?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-21384 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-21384?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21384: Qualcomm Snapdragon Memory Corruption in Prepared Commands

CVE-2026-21384 · Severity: medium · CVSS 5.3 · Published 2026-07-06

A memory corruption vulnerability exists in several Qualcomm Snapdragon chipsets used in mobile devices, automotive systems, and IoT hardware. An attacker with local access to a device could exploit this flaw to interfere with the device's normal operations or potentially gain unauthorized access to sensitive data. This could lead to system instability or a compromise of the device's security boundaries.

Quick answers

Is CVE-2026-21384 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21384 being exploited in the wild.
How severe is CVE-2026-21384?: Medium severity, with a CVSS score of 5.3, published 6 July 2026.
Which products and versions are affected?: Qualcomm, Inc. Snapdragon Auto; Qualcomm, Inc. Snapdragon Compute; Qualcomm, Inc. Snapdragon Consumer IOT; Qualcomm, Inc. Snapdragon Industrial IOT; and 4 more.
Is there a fix for CVE-2026-21384?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21384 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-21384?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability (CWE-787: Out-of-bounds Write) exists in Qualcomm Snapdragon firmware. The issue occurs when updating prepared commands using invalid port indices provided by user-space input that exceeds supported read client limits. An attacker with low-privileged local access can trigger this vulnerability, though it requires high complexity to exploit successfully. If exploited, it can lead to a scope cross (S:C), potentially allowing the attacker to impact the integrity and availability of the underlying system or secure environments. Patch information is available in the July 2026 Qualcomm Security Bulletin.

Affected products

Qualcomm, Inc. Snapdragon Auto
Qualcomm, Inc. Snapdragon Compute
Qualcomm, Inc. Snapdragon Consumer IOT
Qualcomm, Inc. Snapdragon Industrial IOT
Qualcomm, Inc. Snapdragon Mobile
Qualcomm, Inc. FastConnect 6700
Qualcomm, Inc. FastConnect 6900
Qualcomm, Inc. FastConnect 7800

Timeline

2026-07-06: disclosed
2026-07-06: advisory

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.