The vulnerability arises when the camera sensor driver processes an IOCTL call without validating the size of the output buffer. This omission allows the driver to read beyond intended bounds, which can lead to disclosure of sensitive data or a crash of the driver. The weakness is classified as CWE‑126, a memory corruption issue that can compromise confidentiality, integrity, or availability of the affected system.

Qualcomm Snapdragon and related FastConnect, QCA, and WCD families listed in the CPE strings are affected. The CVE description does not specify particular firmware or hardware revisions, indicating that any device containing the vulnerable camera driver before an official fix is potentially at risk.

The CVSS base score of 7.8 places this flaw in the high‑severity range, but the EPSS score of less than 1 % suggests that active exploitation trials are unlikely. The vulnerability is not in the CISA KEV catalog, so no widespread attacks have been reported. Exploitation would require local or privileged access to the IOCTL interface, limiting the attack surface compared to a remote exploit.