CVE-2026-21378

CVE-2026-21378 is a memory corruption vulnerability in camera sensor drivers that occurs when an output buffer is accessed during IOCTL processing without proper size validation. This flaw affects an undetermined range of devices utilizing the vulnerable camera sensor driver code. The vulnerability carries a HIGH severity rating (CVSS 7.8) with a local attack vector requiring low privilege access but no user interaction, resulting in potential compromise of confidentiality, integrity, and availability. Exploitation requires local access to the affected system, though the attack requires minimal complexity to execute. Currently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no indication of active exploitation in the wild. The relatively low EPSS score of 0.00013 suggests minimal real-world exploitation activity at present, though the moderate FAUCET Risk Score of 48.0 warrants attention from organizations running affected hardware.