The vulnerability originates in the camera subsystem when the driver processes sensor I/O control codes with improperly sized output buffers. This flaw allows an attacker to cause a memory corruption that may result in a crash or, in some conditions, arbitrary code execution. The weakness is a classic untrusted pointer dereference, corresponding to CWE‑119: Improper Restriction of Operations within the Bounds of a Memory Buffer, offering potential for confidentiality, integrity, and availability violations.

Qualcomm Snapdragon devices are affected; specific firmware or driver versions are not listed in the public data, so any device utilizing the camera drivers outlined by Qualcomm may be vulnerable.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is <1%, indicating a low exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves crafting malicious camera sensor input or output control commands that a compromised or malicious application could deliver, especially on systems where the camera driver runs with elevated privileges. If successfully exploited, the attacker could gain arbitrary code execution on the device or force a denial of service by crashing the camera subsystem.