The vulnerability is triggered when a Qualcomm Snapdragon kernel module processes multiple IOCTL calls that share the same buffer file‑descriptor input. The use‑after‑free condition occurs after the underlying object has already been freed, leading to memory corruption in the driver. The CVE description does not specify the precise outcome, but such corruption could cause the driver to behave unexpectedly or crash. No explicit mention of denial of service or arbitrary code execution is present.

Qualcomm Snapdragon processors and their associated software stack are affected. The advisory does not list specific firmware or driver versions, so any device implementing the vulnerable image‑processing kernel module on a Snapdragon SoC could be impacted.

The CVSS base score of 6.6 indicates a medium risk level. The EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending crafted IOCTL requests to the vulnerable driver. Based on the description, the likely attack vector is local, requiring the attacker to have the ability to send crafted IOCTL requests to the vulnerable driver.