The vulnerability arises from improper handling of an IOCTL command when a Snapdragon device is in a power‑save state, leading to a memory corruption event (CWE‑787). Depending on the context, this undefined behavior could result in crashes, denial of service, or, if an attacker can supply crafted commands, potentially privilege escalation (CWE‑749). The severity as reflected in the CVSS score of 5.5 indicates a moderate impact but does not preclude significant consequences in constrained environments.

Qualcomm, Inc. Snapdragon family of devices are affected. No specific firmware or driver version information is disclosed, so all installations of the Snapdragon software stack remain potentially vulnerable until an update is released.

The CVSS score of 5.5 suggests moderate risk. The EPSS score is 0.00015, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV, indicating no widespread known exploitation reports. The likely attack vector is local or privileged, requiring an attacker to interact with the IOCTL interface while the device is in power‑save mode or to gain elevated privileges to trigger the corrupted state. Lacking evidence of remote exploitation, the risk is moderate but merits attention, especially for systems that rely on constant device availability.