The DSP Service contains a classic time‑of‑check time‑of‑use race condition that allows an attacker to modify asynchronous input parameters after the service performs validation but before they are actually used. This flaw is classified as CWE‑367 and leads to memory corruption within the DSP privilege escalation is not supported by the CVE text.

Qualcomm Snapdragon processor families that include the DSP Service are potentially affected. No specific firmware revision or hardware version is listed, meaning any device that incorporates this service may be vulnerable and should be audited or updated.

The CVSS score of 7.8 classifies the vulnerability as high severity, but the EPSS score of < 1% indicates that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or remote application that can supply asynchronous input to the DSP Service; the description does not specify required privileges, so it is not known whether privilege escalation is possible. Until mitigated, the risk remains.