CVE-2026-21383

Reusing a Nonce, Key Pair in Encryption in HLOS

State: Published
Severity: 7.1 High
Published: Jul 6, 2026
Updated: Jul 8, 2026
Reserved: Dec 17, 2025

Description

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	qualcomm

Weaknesses

CWE-323 Reusing a Nonce, Key Pair in Encryption

Affected Products

Product	Versions
SnapdragonQualcomm, Inc.	FastConnect 6900Affected FastConnect 7800Affected LeMans_AU_LGITAffected LeMansAUAffected PandeiroAffected QAM8255PAffected QAM8397PAffected QAM8797PAffected QAMSRV1HAffected QAMSRV1MAffected QCA6595AUAffected QCA6696Affected QCA6698AQAffected QCA6797AQAffected QCA8695AUAffected QDU1000Affected QDU1110Affected QDU1210Affected QDX1010Affected QDX1011Affected QLN1083BDAffected QLN1086BDAffected QPA1083BDAffected QPA1086BDAffected Qualcomm Dragonwing X100 Accelerator CardAffected and 28 more versions

Product

Versions

SnapdragonQualcomm, Inc.

FastConnect 6900Affected
FastConnect 7800Affected
LeMans_AU_LGITAffected
LeMansAUAffected
PandeiroAffected
QAM8255PAffected
QAM8397PAffected
QAM8797PAffected
QAMSRV1HAffected
QAMSRV1MAffected
QCA6595AUAffected
QCA6696Affected
QCA6698AQAffected
QCA6797AQAffected
QCA8695AUAffected
QDU1000Affected
QDU1110Affected
QDU1210Affected
QDX1010Affected
QDX1011Affected
QLN1083BDAffected
QLN1086BDAffected
QPA1083BDAffected
QPA1086BDAffected
Qualcomm Dragonwing X100 Accelerator CardAffected
and 28 more versions

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.