The vulnerability stems from using a static initialization vector when performing AES‑GCM key wrapping. AES‑GCM requires a unique nonce for each operation; reusing one can allow an attacker to detect patterns in ciphertext or, in extreme cases, recover the wrapped key, thereby compromising the confidentiality of protected keys.

Qualcomm, Inc. Snapdragon devices whose high‑level operating system components implement AES‑GCM key wrapping with a static IV. This includes firmware and OS layers that handle encryption of keys within the device.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low probability that existing exploits have been found. The vulnerability is not listed in CISA KEV. Because the flaw involves firmware‑level encryption, the attack likely requires local or privileged access to influence the key‑wrapping routine, as inferred from the cryptographic nature of the vulnerability. If exploited, an attacker could recover protected keys and undermine device security.