CVE-2026-21385
Known exploited · CISA KEV
CVSS 7.8 HIGH: memory corruption while using alignments for memory allocation.
CISA federal remediation date Mar 24
Vulnerabilities · 241 days ago
Google disclosed CVE-2026-21385, a memory‑corruption bug in a Qualcomm graphics/display component.
Known exploited · CISA KEV
CVSS 7.8 HIGH: memory corruption while using alignments for memory allocation.
CISA federal remediation date Mar 24
6 sources covering this story
Qualcomm Zero-Day Exploited in Targeted Android Attacks
The exploitation of CVE-2026-21385, a high-severity memory corruption flaw, could be tied to commercial spyware or nation-state threat groups.
Android Update Patches Exploited Qualcomm Zero-Day
An integer overflow or wraparound in the Qualcomm graphics component, the bug leads to memory corruption.
Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited
Google’s March 2026 Android update patches 129 vulnerabilities, including exploited Qualcomm flaw CVE-2026-21385 and critical RCE CVE-2026-0006.
The Android March 2026 security patch fixes flaws across Framework, System, kernel, chipsets, with a CVE confirmed under active exploitation.
Android gets patches for Qualcomm zero-day exploited in attacks
Google has released security updates to patch 129 Android security vulnerabilities, including an actively exploited zero-day flaw in a Qualcomm display component.
Google addresses actively exploited Qualcomm zero-day in fresh batch of 129 Android vulnerabilities
The company’s latest security update contains the highest number of Android vulnerabilities patched in a single month since April 2018.
Part of the PlainSec briefing for 2026-03-05