What is the CVSS score of CVE-2026-21385?

CVE-2026-21385 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Wcn3990 Firmware are affected by CVE-2026-21385?

CVE-2026-21385 is a memory corruption vulnerability actively exploited in the wild, affecting systems using vulnerable memory allocation functions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21385?

Yes, a public proof-of-concept exploit is available for CVE-2026-21385. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-21385?

Within 24 hours: Inventory all affected systems and assess exposure in production environments. Within 7 days: Deploy available vendor patch to all critical and high-priority systems; establish change management approval if not already expedited for critical vulnerabilities. Within 30 days: Complete patching of all remaining systems including development, testing, and lower-priority infrastructure; validate patch effectiveness through security testing.

Wcn3990 Firmware CVE-2026-21385

HIGH

Integer Overflow or Wraparound (CWE-190)

2026-03-02 product-security@qualcomm.com

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Added to CISA KEV

Mar 04, 2026 - 18:13 cisa

CISA KEV

PoC Detected

Mar 04, 2026 - 18:13 vuln.today

Public exploit code

Patch released

Mar 04, 2026 - 18:13 nvd

Patch available

CVE Published

Mar 02, 2026 - 17:16 nvd

HIGH 7.8

DescriptionCVE.org

Memory corruption while using alignments for memory allocation.

Articles & Coverage 1

POC CVE-2026-21385: Qualcomm Display Integer Overflow Scanner POC Mar 22, 2026

AnalysisAI

A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memory allocation, enabling local privilege escalation to kernel level. KEV-listed and patched, this vulnerability affects Qualcomm-based mobile devices and embedded systems, potentially impacting billions of Android devices globally.

Technical ContextAI

The vulnerability occurs in Qualcomm's proprietary firmware during memory allocation where alignment calculations use integer arithmetic that can overflow. This results in undersized memory allocations that are subsequently written beyond their bounds. Because this occurs at the firmware/kernel driver level, successful exploitation provides kernel-level access on affected devices.

RemediationAI

Apply Android security patch level update. OEM firmware updates may be required. Ensure devices receive regular security updates. For enterprise: enforce minimum security patch level via MDM. For high-risk users: verify device patch status.