CVE-2026-21085

MediumCVSS 6.7

Published: 09/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

Out-of-bounds write vulnerability in Keymaster trustlet prior to SMR Sep-2026 Release 1. Allows local privileged attackers to write out-of-bounds memory.

Risk Assessment

A local attacker with privileges could corrupt memory, potentially leading to privilege escalation or unexpected system behavior.

Recommendation

Apply the SMR Sep-2026 Release 1 or later patch to remediate the vulnerability.

Other vulnerabilities in Keymaster

CVE-2014-9974Critical
All Qualcomm products with Android releases from CAF using the Linux kernel have a lack of buffer length validation in Keymaster.

Original NVD description (English source)

Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.