The flaw is a buffer over‑read that occurs when Qualcomm’s computer vision component copies cryptographic data to a destination buffer without first checking the buffer size. This omission can allow an attacker to read beyond the intended memory region, potentially exposing secret data such as cryptographic keys or other sensitive information. The weakness is commonly known as buffer over-read (CWE‑126).

The vulnerability affects Qualcomm’s Snapdragon line, including devices such as the Snapdragon 8 Elite Gen 5, Pandeiro, SW6100, SW6100P, Themisto, WCD9395, WCN7860, WCN7861, WSA8840, WSA8845, and WSA8845H, as well as the corresponding firmware editions. These components are listed in the Qualcomm security bulletin and may be susceptible if they have not been updated to the fixed revision. Exact affected firmware releases are not included in the available data, so any hardware running the affected firmware stack is potentially impacted.

The CVSS base score of 7.1 indicates a high severity risk, while an EPSS score of less than 1% suggests that exploitation is unlikely to be widespread in the near future. The vulnerability is not listed in CISA’s KEV catalog, implying no known large‑scale exploitation. Likely attackers would require local or privileged access to the device, as the over‑read occurs within an internal cryptographic routine rather than through a network interface. Consequently, organizations can assess the risk based on their exposure model, but keeping firmware current is advised.