This vulnerability (CVE-2026-21370) is an out-of-bounds write (CWE-787) in Qualcomm Snapdragon devices caused by insufficient validation of input batch size and buffer plane count, which can exceed maximum allowed values leading to memory corruption. The CVSS 3.1 base score is 5.3 (medium severity) with attack vector local, high attack complexity, low privileges required, no user interaction, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. The vulnerability affects a broad range of Qualcomm Snapdragon versions identified by specific model numbers. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation can cause memory corruption resulting in partial loss of confidentiality, integrity, and availability on affected Qualcomm Snapdragon devices. The attack requires local access with low privileges and has high complexity, limiting exploitability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local access to affected devices and monitor for vendor updates regarding patches or mitigations.