CVE-2026-21380 is a use-after-free vulnerability (CWE-416) in Qualcomm Snapdragon devices caused by memory corruption when using deprecated DMABUF IOCTL calls to manage video memory. The flaw allows an attacker with low privileges and local access to potentially execute arbitrary code or cause denial of service by exploiting the improper handling of video memory buffers. The vulnerability affects a broad range of Snapdragon platforms and components, including FastConnect modules and various WCD and WSA series chips. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. As of the published date, no official patch or remediation level has been provided by Qualcomm, and no known exploits have been observed in the wild.

Successful exploitation of this use-after-free vulnerability can result in memory corruption leading to unauthorized disclosure of information, modification of data, or denial of service on affected Snapdragon devices. The vulnerability requires local access with low privileges and does not require user interaction. The high CVSS score reflects the potential for significant impact on device security and stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been published by Qualcomm, users and administrators should monitor Qualcomm's advisories for updates. Until a patch is available, limiting local access to affected devices and avoiding use of deprecated DMABUF IOCTL calls where possible may reduce risk.