Buffer over-read in Qualcomm products - CVE-2026-21381

Vulnerability identifier: #VU126199

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21381

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in WLAN Firmware. A remote privileged application can execute arbitrary code.

SXR2230P
WCD9395
WCD9390
WCD9385
WCD9380
WCD9378C
WCD9378
WCD9375
WCD9370
WCD9340
SXR2350P
SXR2330P
SXR2250P
WCN3988
Snapdragon X75 5G Modem-RF System
Snapdragon X72 5G Modem-RF System
Snapdragon AR1+ Gen 1 Platform
Snapdragon AR1 Gen 1 Platform
Snapdragon 8 Gen 3 Mobile Platform
Snapdragon 8 Elite Gen 5
Snapdragon 8 Elite
Snapdragon 7s Gen 3 Mobile Platform
Snapdragon 6 Gen 4 Mobile Platform
Snapdragon 6 Gen 3 Mobile Platform
Snapdragon 6 Gen 1 Mobile Platform
SM8750P
WSA8840
XRV9209
XRV7209
XG101039
XG101032
XG101002
X2000094
X2000092
X2000090
X2000086
X2000077
WSA8845H
WSA8845
SM8650Q
WSA8835
WSA8830
WSA8815
WSA8810
WCN7881
WCN7880
WCN7861
WCN7860
WCN6755
WCN6650
WCN6450
QCA6391
QCN9011
QCN6274
QCN6224
QCC710
QCC2076
QCC2073
QCA8337
QCA8081
QCA6797AQ
QCA6787AQ
QCA6777AQ
QCA6698AU
QCN9012
Pandeiro
Palawan25
Orne
Netrani
Milos
G2 Gen 1
FWA Gen 3 Ultra Platform
FastConnect 7800
FastConnect 6900
FastConnect 6700
FastConnect 6200
Cologne
QXM1094
SM8635P
SM8635
SM7675P
SM7675
SM7635P
SM7435
SM6650P
SC8380XP
SAR2130P
SAR1165P
QXM1096
QXM1095
AR8035
QXM1093
QXM1086
QXM1083
QPA1086BD
QPA1083BD
QMP1000
QLN1086BD
QLN1083BD
QFW7124
QFW7114
QCS8550
WSA8832

Install security update from vendor's website.

• https://docs.qualcomm.com/securitybulletin/april-2026-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets (April 2026)