Vulnerabilities ›

CVE-2026-21385

High 🇺🇸 CISA KEV ⚡ Exploit Available

Memory corruption while using alignments for memory allocation.

CWE-190 — Weakness Type

                    Published: Mar 2, 2026                      ·  Modified: Mar 4, 2026                      ·  Source: CISA_KEV                

CVSS v3

7.8

🔗 NVD Official

📄 Description (English)

Memory corruption while using alignments for memory allocation.

🤖 AI Executive Summary

CVE-2026-21385 is a high-severity memory corruption vulnerability (CVSS 7.8) arising from improper alignment handling during memory allocation operations. With public exploits available and patches released, this vulnerability poses an immediate risk to systems using affected components. Organizations must prioritize patching to prevent potential code execution and system compromise.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 28, 2026 22:02

🇸🇦 Saudi Arabia Impact Assessment

This memory corruption vulnerability poses significant risk to Saudi banking infrastructure (SAMA-regulated institutions), government systems (NCA oversight), and critical energy sectors (ARAMCO operations). Telecom providers (STC, Mobily) and healthcare systems utilizing affected memory allocation libraries face potential service disruption and data breach risks. The availability of public exploits elevates risk for organizations with delayed patching cycles.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Energy and Utilities Telecommunications Healthcare Critical Infrastructure

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1055 - Process Injection T1499 - Endpoint Denial of Service T1529 - System Shutdown/Reboot

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

1. IMMEDIATE ACTIONS:

   - Identify all systems and applications using affected memory allocation components

   - Isolate or restrict network access to vulnerable systems pending patch deployment

   - Enable enhanced monitoring for exploitation attempts



2. PATCHING GUIDANCE:

   - Apply vendor patches immediately upon availability confirmation

   - Prioritize production systems in banking, government, and critical infrastructure

   - Test patches in staging environments before production deployment

   - Maintain patch deployment records for compliance audits



3. COMPENSATING CONTROLS (if patching delayed):

   - Implement Address Space Layout Randomization (ASLR) and DEP/NX protections

   - Deploy Web Application Firewalls (WAF) to detect exploitation patterns

   - Restrict user privileges and implement principle of least privilege

   - Enable memory tagging extensions (MTE) on supported ARM64 systems



4. DETECTION RULES:

   - Monitor for abnormal memory allocation patterns and alignment failures

   - Alert on segmentation faults and memory access violations

   - Track unexpected process terminations and core dumps

   - Implement IDS signatures for known exploit payloads

🔧 خطوات المعالجة (العربية)

1. الإجراءات الفورية:

   - تحديد جميع الأنظمة والتطبيقات التي تستخدم مكونات تخصيص الذاكرة المتأثرة

   - عزل أو تقييد الوصول إلى الشبكة للأنظمة الضعيفة قبل نشر التصحيح

   - تفعيل المراقبة المحسنة لمحاولات الاستغلال



2. إرشادات التصحيح:

   - تطبيق تصحيحات البائع فوراً عند تأكيد التوفر

   - إعطاء الأولوية للأنظمة الإنتاجية في البنية التحتية المصرفية والحكومية والحرجة

   - اختبار التصحيحات في بيئات التجريب قبل نشرها في الإنتاج

   - الاحتفاظ بسجلات نشر التصحيحات لتدقيق الامتثال



3. الضوابط البديلة (إذا تأخر التصحيح):

   - تنفيذ عشوائية تخطيط مساحة العناوين (ASLR) وحماية DEP/NX

   - نشر جدران الحماية لتطبيقات الويب (WAF) للكشف عن أنماط الاستغلال

   - تقييد امتيازات المستخدم وتنفيذ مبدأ أقل امتياز

   - تفعيل امتدادات وسم الذاكرة (MTE) على أنظمة ARM64 المدعومة



4. قواعد الكشف:

   - مراقبة أنماط تخصيص الذاكرة غير الطبيعية وفشل المحاذاة

   - التنبيه على أخطاء التقسيم وانتهاكات الوصول إلى الذاكرة

   - تتبع إنهاء العمليات غير المتوقعة والتفريغات الأساسية

   - تنفيذ توقيعات IDS لحمولات الاستغلال المعروفة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 - 5.2.1: System Hardening and Secure Configuration ECC 2024 - 5.3.1: Vulnerability Management and Patch Management ECC 2024 - 5.4.1: Incident Detection and Response

🔵 SAMA CSF

SAMA CSF - ID.RA-1: Asset Management and Vulnerability Identification SAMA CSF - PR.IP-12: System Development and Maintenance SAMA CSF - DE.CM-1: Detection and Analysis

🟡 ISO 27001:2022

ISO 27001:2022 - A.12.6.1: Management of technical vulnerabilities ISO 27001:2022 - A.14.2.1: Secure development policy ISO 27001:2022 - A.12.2.1: Monitoring and logging

🟣 PCI DSS v4.0.1

PCI DSS 4.0 - 6.2: Security patches and updates PCI DSS 4.0 - 11.2: Vulnerability scanning and assessment

🔗 References & Sources 3

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin....

product-security@qualcomm.com

🔗

https://source.android.com/docs/security/bulletin/2026/2026-03-01

134c704f-9b21-4f2e-91b3-4a467353bcc0

🔗

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385

134c704f-9b21-4f2e-91b3-4a467353bcc0

📊 CVSS Score

7.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.8

CWECWE-190

EPSS0.65%

Exploit ✓ Yes

Patch ✓ Yes

CISA KEV🇺🇸 Yes

KEV Due Date2026-03-24

Published 2026-03-02

Source Feed cisa_kev

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

kev actively-exploited

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-21385

💬 Comments

Introduce Yourself

Sign In Required