Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited
Summary: Google disclosed on Monday that CVE-2026-21385, a high-severity buffer over-read in an open-source Qualcomm Graphics component used in Android devices, has been exploited in the wild, with Qualcomm describing it as an integer overflow caused by adding user-supplied data without checking available buffer space. Qualcomm says the flaw was reported through Google's Android Security team on December 18, 2025, and customers were notified on February 2, 2026; Google's March 2026 bulletin patches 129 vulnerabilities and notes indications of limited, targeted exploitation.
Why it matters: CISA added CVE-2026-21385 to its KEV catalog on March 3, 2026, which requires Federal Civilian Executive Branch agencies to apply fixes by March 24, 2026 - a three-week window for a flaw already being exploited against targets.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-43859CVE-2025-48631CVE-2026-0006CVE-2026-0027CVE-2026-0028CVE-2026-0030CVE-2026-0031CVE-2026-0037CVE-2026-0038CVE-2026-0047CVE-2026-21385
- Related
- CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2026