A buffer copy operation in Qualcomm power‑management firmware does not validate the size of its input or output buffers. The flaw, identified as a buffer overflow (CWE-120), can corrupt memory during power‑management requests, potentially enabling an attacker to alter device state, trigger denial of service, or elevate privileges if the corruption is exploitable.

The vulnerability exists in Qualcomm Snapdragon power‑management integrated circuits across several firmware families, including cologne, fastconnect_6900, fastconnect_7800, qca0000, sc8380xp, wcd9378c, wcd9380, wcd9385, wsa8840, wsa8845, wsa8845h, and multiple xg10100x variants. The exact firmware or hardware revisions containing the vulnerable code are not specified in the advisory.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, implying no publicly known exploit at this time. Exploitation would require an attacker to send a crafted power‑management request over the device’s control interface, indicating a local or privileged access requirement. Even though the impact is confined to the affected device, critical systems relying on Snapdragon PMICs could experience operational disruption if the vulnerability is leveraged.