The vulnerability arises from a weak configuration during the package extraction process within Qualcomm Software Center, allowing an attacker to gain higher privileges. The weakness is an uncontrolled search path element (CWE-427) and the CVSS score of 8.8 indicates a high severity risk of privilege escalation.

Qualcomm, Inc. Snapdragon products that run Qualcomm Software Center and use the vulnerable extraction process are affected. No specific product versions are listed, so all versions employing this extraction routine may be vulnerable.

The CVSS score of 8.8 signals a serious vulnerability, but the EPSS score is not provided, leaving exploitation probability uncertain. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is documented. Based on the description, it is inferred that the attack would likely require local access or the ability to initiate the extraction routine with malicious inputs, indicating a local privilege escalation scenario.