CISA warns of Qualcomm Chipsets Memory Corruption Vulnerability Exploited in Attacks

CISA has warned that a memory corruption flaw in Qualcomm chipsets is being exploited in attacks, urging organizations to promptly apply vendor-provided mitigations.

The issue, tracked as CVE-2026-21385, impacts multiple Qualcomm chipsets and was added to CISA’s catalog on 2026-03-03 with a remediation deadline of 2026-03-24.

While public details remain limited, CISA’s inclusion typically signals credible evidence of real-world exploitation.

CVE-2026-21385 is a memory corruption vulnerability that occurs during memory allocation using alignments across multiple Qualcomm chipsets.

The related weakness is CWE-190 (Integer Overflow or Wraparound), which can cause calculations to “wrap” unexpectedly and lead to incorrect buffer sizes or offsets.

Vendor	Product	CVE	Summary	CWE
Qualcomm	Multiple Chipsets	CVE-2026-21385	Memory corruption while using alignments for memory allocation	CWE-190

In practical terms, a flawed size or alignment computation can result in out-of-bounds writes, memory corruption, and crashes.

Potentially code execution in a vulnerable component, depending on where the bug exists and what privileges that component has.

Because Qualcomm chipsets power a wide range of Android phones, tablets, and embedded/IoT devices, overall exposure varies by device.

The risk depends on the vendor, the specific chipset in use, and whether the vulnerable driver, firmware, or software component is present.

At the time of writing, CISA’s note does not state whether the exploitation is tied to ransomware campaigns; that field remains unknown.

Organizations should prioritize patching paths that deliver Qualcomm fixes: OEM firmware updates, device OS/security updates, and any vendor-specific advisories for affected models.

If mitigations are unavailable, CISA advises discontinuing use of the product, and organizations should apply applicable BOD 22-01 guidance for cloud services where relevant to their environment.

For monitoring, focus on signals that can accompany memory corruption exploitation:

Monitoring Focus Area	Indicators to Watch For
Device Stability	Unexpected reboots or instability
Service Health	Repeated crashes in low-level services
Privilege Behavior	Abnormal privilege-related activity after firmware/OS updates

Where feasible, tighten mobile/endpoint controls (MDM compliance, update enforcement, and sideloading restrictions) to reduce the window between disclosure and patch adoption.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.