An integer overflow occurs during the creation of an attestation report, causing a buffer copy operation to write beyond the bounds of allocated memory. This memory corruption can destabilize the system or, if successfully exploited, may allow an attacker to execute arbitrary code or cause a denial of service. The impact is therefore a potential compromise of integrity and availability of the affected platform.

Qualcomm Snapdragon family devices and associated automotive platform chips are affected, including mobile processors such as Snapdragon 460, 480, 680, 690, 695, various 6‑generation and 7‑generation models, and automotive firmware modules such as ar8035, cologne, csra6620, fastconnect series, and many other listed CPE identifiers. All referenced Qualcomm devices that lack the latest firmware update may be vulnerable.

The CVSS score of 7.8 indicates high severity, yet the EPSS score of less than 1 % suggests a currently low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. The attack likely requires triggering the attestation report generation, which may be initiated locally or via exposed interfaces, and could lead to code execution or a system crash if not mitigated.