CVE-2026-21379

Executive Summary

CVE-2026-21379 is an unpatched memory-corruption vulnerability in Qualcomm's Windows Compute runtime components, specifically triggered when the driver attempts to allocate memory with sizes exceeding the maximum allowed value. This flaw enables a buffer over-read condition (CWE-119), allowing a low-privileged local attacker to escalate privileges to SYSTEM and achieve full system compromise, including arbitrary code execution in the kernel context. The vulnerability affects enterprise endpoints utilizing Qualcomm Compute drivers (e.g., Snapdragon-based Windows-on-ARM devices, AI-accelerator modules), and no vendor patch or workaround has been released as of this report.

Technical Analysis

The vulnerability resides in the memory-allocation path of the Qualcomm Compute driver (likely part of the Qualcomm Windows Compute runtime, qcadsp or related DSP/AI accelerator user-mode-to-kernel-mode transition layer). The root cause is a failure to validate size parameters against an upper-bound limit before passing them to a kernel-mode allocation routine (e.g., ExAllocatePoolWithTag or MmAllocateContiguousMemory). When a malicious caller supplies an allocation size that exceeds the kernel's maximum allowable value, the arithmetic wraparound or truncation leads to an undersized buffer being allocated, followed by a subsequent read/write operation that overruns the buffer boundaries.

Attack surface: The vulnerable API is reachable from user mode via IOCTL calls to the Qualcomm device driver. A low-privileged attacker (e.g., a malware process running as a standard user) can craft an IOCTL request with a malformed size field. Because the driver does not perform a bounds check (size > MAX_ALLOC), the kernel treats the value as valid, allocates a smaller buffer than expected, and then copies attacker-controlled data into it, causing a buffer over-read or out-of-bounds write.

Code-level explanation: The vulnerable pattern is typical of a missing integer-range validation:

// Vulnerable pattern
ULONG_PTR user_size = get_user_input_ioctl(pIoBuffer);
PUCHAR ptr = AllocateMemory(user_size); // no check: user_size > MAX_SIZE
CopyFromUser(ptr, user_data, user_size); // over-read/write

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C:C:H/I:H/A:H vector reflects high complexity requirements being low, no user interaction needed, and a changed security scope — meaning successful exploitation compromises more than the vulnerable component (the entire OS kernel).

Exploitation Scenarios

Preconditions: Attacker has local access to a Windows device with Qualcomm Compute drivers installed, and a user-level shell or ability to execute code (e.g., via a dropped dropper). No admin privileges required.

Step-by-step attack chain:

1. Reconnaissance (Target Identification): The attacker enumerates available device objects by running !devobj or using WinObj to list driver devices, specifically targeting the Qualcomm Compute interface (e.g., \\.\QCADSPService or \\.\qcex). Alternatively, the attacker uses sc query or driverquery to confirm the presence of the vulnerable driver (qcadsp.sys or qcnet.dll variants).

2. Weaponization: The attacker crafts a malicious IOCTL buffer. Using a language like C or Python (via ctypes), they call CreateFile on the device, then DeviceIoControl with a control code that maps to the compute subsystem's memory-allocation routine. The input buffer contains a size field set to 0xFFFFFFFF (or a value exceeding the documented MAX_ALLOC limit, e.g., 0x80000000 for a 2GB boundary on 32-bit allocation paths).

3. Trigger Execution: The attacker sends the IOCTL. The driver enters its dispatch routine, extracts the size field, and passes it directly to the internal AllocateMemory function. Because the driver lacks an upper-bound check, the kernel's memory manager truncates the request (wraps around) and returns a pointer to a small buffer (e.g., 4KB instead of 4GB). The driver then performs a RtlCopyMemory with the original (oversized) length, causing a massive out-of-bounds read/write.

4. Payload/Execution: The attacker overlays a staged payload in memory that will be read during the over-read. By controlling the data copied, they can leak kernel memory (e.g., pool addresses, token pointers) in a first pass. In a second pass, they adjust the buffer contents to overwrite a kernel function pointer or a token structure field, achieving privilege escalation to SYSTEM. The attacker then spawns a cmd.exe or launches a backdoor with elevated privileges.

5. Post-Exploitation Impact: With SYSTEM privileges, the attacker disables security tooling (EDR, antivirus), extracts credentials from LSASS, installs a kernel rootkit, or establishes persistence via a scheduled task or WMI subscription. On enterprise endpoints, this could also lead to lateral movement if the device has domain-joined network access.

Impact Assessment

Business Impact: Full compromise of any Windows device with Qualcomm Compute drivers. Given the high CVSS sub-scores — Confidentiality, Integrity, and Availability all rated High (H), and a Changed ("S:C") scope — exploitation can pivot from a single low-privileged process to total OS takeover. Business impact includes data exfiltration, ransomware deployment, and destruction of endpoint integrity.

Affected Systems: Qualcomm Snapdragon-equipped Windows laptops, tablets, and AI-accelerated workstations (e.g., Snapdragon X Elite series, early ARM Windows builds) running vendor-provided Compute drivers. Because the CVE is unpatched, every enterprise environment with these devices is at risk.

Blast Radius: Local attack only (AV:L), so the immediate blast radius is limited to the device. However, in a corporate AD environment, a compromised endpoint can serve as a foothold for lateral movement, expanding the radius to the entire network. EPSS score (0.00070) indicates low current exploitation likelihood, but PoC publication increases the urgency.

Detection Guidance

Sigma Rule

title: Qualcomm Compute Driver Unvalidated Allocation Size
id: 4f4a1a2b-1e2d-4f3c-8a9b-6c5f2d4e9a01
status: experimental
description: Detects suspicious IOCTL calls to Qualcomm Compute driver with oversized allocation sizes
author: Valtersit Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\DeviceIoControl.exe'  # or common loader tools
        CommandLine|contains:
            - 'QCADSPService'
            - 'qcex'
            - 'DeviceIoControl'
    condition: selection
    level: high
falsepositives:
    - Legitimate diagnostics tools querying device capabilities
fields:
    - CommandLine
    - ParentImage
tags:
    - attack.privilege_escalation
    - attack.t1068

YARA Rule

rule CVE_2026_21379_Qualcomm_Compute_IOCtl_Pattern
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects binary patterns indicating oversized allocation in Qualcomm compute calls"
        cve = "CVE-2026-21379"
    strings:
        $ioctl_device = { 5C 5C 2E 5C 51 43 41 44 53 50 }  // \\.\QCADSP
        $size_overflow = { FF FF FF 7F }                   // 0x7FFFFFFF or similar
        $call_createfile = "CreateFileA" ascii
        $call_deviceiocontrol = "DeviceIoControl" ascii
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header check
        any of ($ioctl_device) and
        (any of ($size_overflow) or any of ($call_deviceiocontrol))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-21379 Qualcomm Compute IOCTL Oversized Allocation Attempt"; content:"DeviceIoControl"; content:"QCADSPService"; content:"FF FF FF 7F"; within:20; classtype:attempted-admin; sid:202621379; rev:1;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name : "*cmd*" or process.name : "*powershell*"]
  [file where event.type == "creation" and file.name : "*exploit*.exe" and process.name : "*exploit*.exe"]
  [any where event.category : "process" and process.command_line : "*DeviceIoControl*QCADSPService*"]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688 (CommandLine="*DeviceIoControl*" OR CommandLine="*QCADSPService*")
| eval size_val = regex(CommandLine, "0x[0-9A-Fa-f]{7,8}")
| where tonumber(size_val, 16) > 2147483647
| table _time, host, user, CommandLine, ParentProcessId

Wazuh OSSEC Rule

<group name="windows, cve-2026-21379,">
  <rule id="130855" level="12">
    <decoded>
      <command>DeviceIoControl</command>
      <argument name="device">*QCADSPService*</argument>
    </decoded>
    <description>Potential CVE-2026-21379 exploitation attempt: unvalidated allocation size in Qualcomm Compute driver</description>
    <group>attack.privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No vendor patch, no advisory, no workaround has been published. The vendor (Qualcomm) has not acknowledged the CVE.

Immediate Mitigations:

1. Restrict access to the driver device object: Use Windows security policy to deny standard users CreateFile access to \\.\QCADSP and related devices (icacls or SDDL modification via driver registry key).
2. Disable the vulnerable compute service if not in use: Stop and disable the Qualcomm Compute service (sc stop QComputationService; sc config QComputationService start= disabled).
3. Monitor and alert on IOCTL calls to the device as described in the Sigma/YARA rules above.
4. Apply OS-level exploit mitigations: Enable Hardware-enforced Stack Protection (if available on ARM) and Mandatory ASLR.

Patch/Upgrade Steps:

• No patch available. Check the vendor's security bulletin page weekly; if Qualcomm releases a firmware/driver update, apply it immediately in a test environment first.
• If the device is a managed enterprise asset, track the new driver version and deploy via SCCM/Intune once it becomes available.

Long-Term Hardening:

1. Virtualize device access: Run any workload requiring the Compute driver in a restricted session container.
2. Enable AppLocker or WDAC to block unauthorized binaries from calling DeviceIoControl on unknown devices.
3. Use a EDR with behavioral detection for anomalous high-volume IOCTL traffic.
4. Segregate network access for affected endpoints to limit lateral movement.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-21379
2. CNA (Qualcomm Security Advisory): https://qualcomm.com/support/security-bulletins/ (no specific advisory published yet)
3. MITRE CVE List: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21379
4. CISA KEV: Not listed — no exploitation in the wild as of this report.

Known Threat Actor Campaigns: None identified. The CVE is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS percentile is 0.0%, indicating negligible current exploit activity. However, public PoC publication increases the likelihood of weaponization in the near term.