A buffer over-read occurs when the camera driver processes an IOCTL request and reads an output buffer without verifying its size. The vulnerability can corrupt memory locations that hold sensitive data, potentially allowing an attacker to read adjacent memory contents or cause a crash. These unexpected reads may expose confidential information or disrupt device operation.

Qualcomm devices that incorporate Snapdragon chipset firmware, including the Snapdragon 460, 662, 7C, 7C+, 8C, 8CX, AQT1000, Cologne, FastConnect and numerous video collaboration platforms. Affected firmware and hardware variants span many model families, all running Qualcomm‑derived camera drivers.

The CVSS score of 7.8 places this vulnerability in the High severity category. With an EPSS score below 1 % and not listed in the KEV catalog, exploitation probability is low but not negligible. Crafting a malicious IOCTL to trigger the over-read requires local access to the camera interface; therefore, an attacker with device or privileged access could trigger memory corruption, leading to data leakage or a denial‑of‑service condition. Overall risk is moderate, with a small window for exploitation should the attacker gain local control of the affected device.