An out-of-bounds write in the DSP Service can corrupt memory during escape handling when user buffers are too small, potentially allowing arbitrary code to be executed or the system to be compromised. This is a classic memory corruption vulnerability identified as CWE-787, where unchecked buffer sizes lead to memory corruption that an attacker could leverage to hijack execution flow or gain elevated privileges. The impact is the loss of integrity and confidentiality of the target system, and if exploited, can allow a local user or an attacker with access to the DSP Service to execute code in the privileged context.

Qualcomm Snapdragon devices running the DSP Service are affected. Specific affected product versions are not listed in the advisory, so all releases that include the vulnerable DSP Service are potentially impacted until a vendor update is provided.

The CVSS score of 7.8 indicates high severity, while the EPSS score of fewer than 1% shows that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog, implying that there is no confirmed widespread exploitation at this time. Based on the description, it is inferred that the attack vector is local – an attacker would need to exploit a local process or user buffer limitation to trigger the out-of-bounds write. Without a remote code path being explicitly described, the risk is primarily local to the device or system where the DSP Service runs.