A static initialization vector is reused to wrap AES‑GCM keys, violating the requirement that each encryption operation use a unique nonce to preserve confidentiality. Reuse can allow an attacker who can influence the key‑wrapping routine to analyze ciphertext patterns or recover the wrapped key, representing a cryptographic weakness (CWE‑323).

Qualcomm Snapdragon devices running the Snapdragon operating environment. No specific firmware or OS version numbers are provided in the advisory, so all affected Snapdragon releases that use the static IV for key wrapping may be vulnerable.

The CVSS score of 7.1 and an EPSS score of < 1% indicate a moderate severity but a low likelihood of active exploitation, and the issue is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to influence the key‑wrapping routine—potentially through privileged software or a remote code execution path that calls the encryption function—to exploit the weakness.