The vulnerability is an out-of-bounds write in the Snapdragon camera driver that occurs when flash commands are processed. Outdated LED count values are used after a user‑space modification, allowing a memory corruption in the kernel. This flaw can overwrite adjacent memory, potentially compromising the integrity of the system or leading to arbitrary code execution if exploitable. The weakness is indexed as CWE‑787.

The vulnerability affects Qualcomm Snapdragon platform camera drivers. No specific firmware or OS version is documented in the public advisory. The issue may impact any device that relies on the vendor’s camera driver for flash command handling, including smartphones, tablets, or embedded devices running Qualcomm Snapdragon hardware.

Risk and exploitability CVSS score is 5.3, indicating a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves a local user or application that can send custom flash commands to the camera driver, which could consume the corrupted LED count data. The exploit would require the attacker to have privileges that allow interaction with the driver, making this flaw a candidate for local privilege escalation or, in an attacker‑controlled device, a potential gateway to remote code execution if the kernel is compromised. While no official solution or workaround is published, the flaw is accessible through the camera subsystem and might be mitigated by disabling or restricting camera access until a vendor patch is released.