This vulnerability (CVE-2026-21384) is classified as CWE-787 (Out-of-bounds Write) and affects various Qualcomm Snapdragon chipsets. It arises from improper handling of user space input when updating prepared commands, specifically when invalid port indices exceed supported read client limits, leading to memory corruption. The CVSS 3.1 base score is 5.3 (medium severity) with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability at low levels with scope changed. There is no vendor advisory or patch available at this time.

Successful exploitation could lead to memory corruption, potentially allowing an attacker with local access and low privileges to cause limited confidentiality, integrity, and availability impacts on affected Qualcomm Snapdragon devices. The attack complexity is high, and no user interaction is required. The scope of impact is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitoring Qualcomm's advisories for updates is recommended. No specific mitigations are documented at this time.