Technical impact
The vulnerability is a memory corruption flaw that occurs while the DSP service processes IOCTL escape operations. It permits an out-of-bounds read, exposing sensitive data that the caller should not be able to access. This is a CWE‑125 condition and can lead to confidentiality or integrity compromise if the attacker can obtain the leaked data.
Affected Systems
Qualcomm Snapdragon processors and associated DSP services are affected. Version information has not been disclosed by Qualcomm, so all current releases that include the impacted DSP driver are potentially vulnerable.
Risk and Exploitability
The CVSS score of 7.8 signals a high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA's KEV catalog, suggesting no widely known exploitation. The likely attack vector is a local or privileged user able to invoke the vulnerable IOCTL calls on the DSP device. An attacker could use the out-of-bounds read to extract memory contents, potentially leading to further compromise if sensitive data is obtained.
