This vulnerability (CVE-2026-21368) is classified as CWE-787 (Out-of-bounds Write) and occurs in Qualcomm Snapdragon products during the parsing of JPEG commands. The root cause is memory corruption caused by extra writes to a buffer that are not properly accounted for during validation checks. The CVSS 3.1 base score is 5.3 (medium severity), with attack vector local, high attack complexity, low privileges required, no user interaction, and a scope change. The impact includes low confidentiality, integrity, and availability impacts. The vulnerability affects a broad range of Qualcomm Snapdragon chipsets and wireless connectivity modules as explicitly listed. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability can lead to memory corruption through out-of-bounds writes when processing JPEG commands, potentially impacting confidentiality, integrity, and availability at a low level. The attack requires local access with low privileges and has high complexity, limiting the likelihood of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by Qualcomm, users should monitor vendor communications for updates. No specific mitigations or workarounds are currently documented.