CVE-2021-1905

CVE-2021-1905 is a use-after-free flaw (CWE-416) in firmware for a broad set of Qualcomm chipsets, caused by improper handling of memory mapping of multiple processes simultaneously. A local attacker who can already run low-privileged code on an affected device can trigger the stale-memory access, and with high confidentiality, integrity, and availability impact (CVSS 3.1 7.8, local vector, low privileges), successful exploitation can yield arbitrary code execution and privilege escalation. It affects devices built on Snapdragon platforms across the Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables lines, with CISA listing chipset firmware including APQ8009, APQ8017, APQ8053, APQ8096AU, AQT1000, AR8031/8035/8151, and CSRA6620/6640. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03, and contemporaneous reporting described a Qualcomm zero-day under active targeted attacks that was quietly patched in that month's Android security updates, confirming exploitation in the wild. No public proof-of-concept is known, and EPSS estimates about a 1.5% probability of exploitation in the next 30 days (73rd percentile).

What to do: Apply the updated chipset firmware/drivers per Qualcomm's security advisory, and for phones and tablets install the latest Android monthly security update (November 2021 or later, per related reporting) and verify the device's security patch level. Because exploitation requires local code execution (AV:L), prioritize patching endpoints used by high-risk or targeted users and check with automotive, IoT, and networking equipment vendors for updated firmware. No workaround is documented, so treat KEV-listed, unpatched devices as at risk.