CVE-2026-21383

highpriority · track · 0EPSS 0.001 · 1 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.10% (1st) EPSS

CVSS 7.1 · high

Is it mine?

111 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cert_bund

EPSS · scored 2026-10-27

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · product-security@qualcomm.comexploitability 1.8 · impact 5.2

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-323US

affected products (111)

Products and version ranges known to be affected.

Dell Computerall versionscert_bundDEcpe:/o:dell:dell_computer:-
Google Android <2026-09-01all versionscert_bundDE
Google Android <2026-09-05all versionscert_bundDE
Google Android< 2026-09-01cert_bundDE
Google Android< 2026-09-05cert_bundDE
Qualcomm, Inc. Snapdragon≤ SA7775Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QDU1000enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ FastConnect 6900enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SRV1Henisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA8770Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QCA6696enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SXR2230Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA7255Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA8620Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ LeMansAUenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QXM1093enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QXM1095enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QLN1083BDenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QDU1110enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA9000Penisa_euvdEU

showing 20 of 111

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3251Android Patchday September 2026: Mehrere SchwachstellenDeutsch2026-09-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund NVD CVE.org MITRE

published 2026-07-06modified 2026-10-25

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan