This vulnerability (CVE-2026-21368) is an out-of-bounds write (CWE-787) in Qualcomm Snapdragon devices caused by improper handling of extra writes to a buffer during JPEG command parsing validation. The flaw leads to memory corruption, potentially impacting confidentiality, integrity, and availability. The affected products include a range of Snapdragon chipsets identified by specific model numbers. The CVSS 3.1 base score is 5.3 with attack vector local, high attack complexity, low privileges required, no user interaction, scope changed, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported.

The vulnerability can cause memory corruption through out-of-bounds writes when parsing JPEG commands, which may lead to partial compromise of confidentiality, integrity, and availability of the affected device. The CVSS score of 5.3 reflects a medium severity impact. Since the attack vector is local and requires low privileges with high complexity, exploitation is limited but possible under certain conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should follow Qualcomm's security recommendations and avoid processing untrusted JPEG content on affected devices. Monitor for vendor updates regarding patches or mitigations.