CVE-2026-21383
Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.10%
- CWE
- CWE-323
- Published
- 2026-07-06
- Last modified
- 2026-07-08
Affected products
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
- Qualcomm, Inc. Snapdragon
Weakness type
Related vulnerabilities
- CVE-2026-81341 — wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records
- CVE-2026-81020 — wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- CVE-2026-81019 — wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- CVE-2026-50577 — ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
- CVE-2026-17578 — Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
- CVE-2026-59099 — Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
- CVE-2026-13602 — Session takeover vulnerability
- CVE-2026-56369 — ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage