CVE-2026-21383 - Vulnerability Details - OpenCVE

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html

History

Mon, 06 Jul 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 06 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.
Title		Reusing a Nonce, Key Pair in Encryption in HLOS
Weaknesses		CWE-323
References		https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2026-07-06T20:09:39.251Z

Updated: 2026-07-06T20:55:34.146Z

Reserved: 2025-12-17T04:35:45.743Z

Link: CVE-2026-21383

Vulnrichment

Updated: 2026-07-06T20:55:30.938Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21383", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "dateReserved": "2025-12-17T04:35:45.743Z", "datePublished": "2026-07-06T20:09:39.251Z", "dateUpdated": "2026-07-06T20:55:34.146Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon Auto", "Snapdragon CCW", "Snapdragon Compute", "Snapdragon Industrial IOT", "Snapdragon Mobile"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "FastConnect 6900"}, {"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "LeMans_AU_LGIT"}, {"status": "affected", "version": "LeMansAU"}, {"status": "affected", "version": "Pandeiro"}, {"status": "affected", "version": "QAM8255P"}, {"status": "affected", "version": "QAM8397P"}, {"status": "affected", "version": "QAM8797P"}, {"status": "affected", "version": "QAMSRV1H"}, {"status": "affected", "version": "QAMSRV1M"}, {"status": "affected", "version": "QCA6595AU"}, {"status": "affected", "version": "QCA6696"}, {"status": "affected", "version": "QCA6698AQ"}, {"status": "affected", "version": "QCA6797AQ"}, {"status": "affected", "version": "QCA8695AU"}, {"status": "affected", "version": "QDU1000"}, {"status": "affected", "version": "QDU1110"}, {"status": "affected", "version": "QDU1210"}, {"status": "affected", "version": "QDX1010"}, {"status": "affected", "version": "QDX1011"}, {"status": "affected", "version": "QLN1083BD"}, {"status": "affected", "version": "QLN1086BD"}, {"status": "affected", "version": "QPA1083BD"}, {"status": "affected", "version": "QPA1086BD"}, {"status": "affected", "version": "Qualcomm Dragonwing X100 Accelerator Card"}, {"status": "affected", "version": "QXM1093"}, {"status": "affected", "version": "QXM1094"}, {"status": "affected", "version": "QXM1095"}, {"status": "affected", "version": "QXM1096"}, {"status": "affected", "version": "SA7255P"}, {"status": "affected", "version": "SA7775P"}, {"status": "affected", "version": "SA8255P"}, {"status": "affected", "version": "SA8620P"}, {"status": "affected", "version": "SA8770P"}, {"status": "affected", "version": "SA9000P"}, {"status": "affected", "version": "SAR1165P"}, {"status": "affected", "version": "SAR2130P"}, {"status": "affected", "version": "Snapdragon AR1 Gen 1 Platform"}, {"status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform"}, {"status": "affected", "version": "SRV1H"}, {"status": "affected", "version": "SRV1M"}, {"status": "affected", "version": "SXR2230P"}, {"status": "affected", "version": "SXR2250P"}, {"status": "affected", "version": "WCD9380"}, {"status": "affected", "version": "WCD9385"}, {"status": "affected", "version": "WCN3950"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "XRV7209"}, {"status": "affected", "version": "XRV9209"}]}], "descriptions": [{"lang": "en", "value": "Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-323", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2026-07-06T20:09:39.251Z"}, "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html"}], "title": "Reusing a Nonce, Key Pair in Encryption in HLOS"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T20:55:25.178549Z", "id": "CVE-2026-21383", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T20:55:34.146Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21383", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T20:55:25.178549Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T20:55:30.938Z"}}], "cna": {"title": "Reusing a Nonce, Key Pair in Encryption in HLOS", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "FastConnect 6900"}, {"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "LeMans_AU_LGIT"}, {"status": "affected", "version": "LeMansAU"}, {"status": "affected", "version": "Pandeiro"}, {"status": "affected", "version": "QAM8255P"}, {"status": "affected", "version": "QAM8397P"}, {"status": "affected", "version": "QAM8797P"}, {"status": "affected", "version": "QAMSRV1H"}, {"status": "affected", "version": "QAMSRV1M"}, {"status": "affected", "version": "QCA6595AU"}, {"status": "affected", "version": "QCA6696"}, {"status": "affected", "version": "QCA6698AQ"}, {"status": "affected", "version": "QCA6797AQ"}, {"status": "affected", "version": "QCA8695AU"}, {"status": "affected", "version": "QDU1000"}, {"status": "affected", "version": "QDU1110"}, {"status": "affected", "version": "QDU1210"}, {"status": "affected", "version": "QDX1010"}, {"status": "affected", "version": "QDX1011"}, {"status": "affected", "version": "QLN1083BD"}, {"status": "affected", "version": "QLN1086BD"}, {"status": "affected", "version": "QPA1083BD"}, {"status": "affected", "version": "QPA1086BD"}, {"status": "affected", "version": "Qualcomm Dragonwing X100 Accelerator Card"}, {"status": "affected", "version": "QXM1093"}, {"status": "affected", "version": "QXM1094"}, {"status": "affected", "version": "QXM1095"}, {"status": "affected", "version": "QXM1096"}, {"status": "affected", "version": "SA7255P"}, {"status": "affected", "version": "SA7775P"}, {"status": "affected", "version": "SA8255P"}, {"status": "affected", "version": "SA8620P"}, {"status": "affected", "version": "SA8770P"}, {"status": "affected", "version": "SA9000P"}, {"status": "affected", "version": "SAR1165P"}, {"status": "affected", "version": "SAR2130P"}, {"status": "affected", "version": "Snapdragon AR1 Gen 1 Platform"}, {"status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform"}, {"status": "affected", "version": "SRV1H"}, {"status": "affected", "version": "SRV1M"}, {"status": "affected", "version": "SXR2230P"}, {"status": "affected", "version": "SXR2250P"}, {"status": "affected", "version": "WCD9380"}, {"status": "affected", "version": "WCD9385"}, {"status": "affected", "version": "WCN3950"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "XRV7209"}, {"status": "affected", "version": "XRV9209"}], "platforms": ["Snapdragon Auto", "Snapdragon CCW", "Snapdragon Compute", "Snapdragon Industrial IOT", "Snapdragon Mobile"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html"}], "descriptions": [{"lang": "en", "value": "Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-323", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2026-07-06T20:09:39.251Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21383", "state": "PUBLISHED", "dateUpdated": "2026-07-06T20:55:34.146Z", "dateReserved": "2025-12-17T04:35:45.743Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2026-07-06T20:09:39.251Z", "assignerShortName": "qualcomm"}, "dataVersion": "5.2"}