The vulnerability is a heap‑based buffer overflow triggered by malformed IOCTL requests that contain invalid buffer sizes when the driver performs a memcpy operation. The overflow corrupts heap memory and can lead to arbitrary code execution or a denial of service on the device. This flaw is identified as CWE‑122, indicating an unbounded write into adjacent memory.

Affected systems encompass Qualcomm Snapdragon platforms and their firmware, including Snapdragon 460, Snapdragon 662, Snapdragon 7c+ Gen 3 Compute, FastConnect modules, Video Collaboration platforms, and associated firmware components. The broad list of CPEs shows that both the operating system and the specialized DSP/firmware layers may be impacted.

The reported CVSS score of 7.8 reflects high severity, yet the EPSS score of less than 1 % points to a low probability of real‑world exploitation, and the flaw is not listed in CISA’s KEV catalog. Therefore, the exposure is moderate. The likely attack vector is local: an attacker must interact with the vulnerable driver and send malformed IOCTLs; remote exploitation would require the driver to be exposed over a network or via a privileged service, which is not explicitly documented.