CVE-2026-21370: CWE-787: Out-of-bounds Write in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-21370) is classified as CWE-787 (Out-of-bounds Write) and affects multiple Qualcomm Snapdragon products. It arises from memory corruption caused by insufficient validation of input batch size and buffer plane count, which can exceed the maximum allowed values. The CVSS 3.1 base score is 5.3 (medium severity) with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability in a scope-changing manner. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation could lead to memory corruption affecting confidentiality, integrity, and availability of the affected Snapdragon components. The vulnerability requires local access with low privileges and has a high attack complexity, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Qualcomm's advisories for updates. No specific mitigation or workaround is provided by the vendor at this time.