The vulnerability is a use‑after‑free in Qualcomm’s DSP Service that occurs when geographic mapping data is accessed and modified concurrently without proper synchronization. The memory corruption can allow an attacker to corrupt data structures or execute arbitrary code, potentially leading to denial of service or further compromise. This weakness is classed as CWE‑416.

The affected systems are Qualcomm Snapdragon devices running the DSP Service that handles geographic mapping data. No specific firmware, ROM, or software versions are listed, so any Snapdragon implementation using this service is potentially vulnerable unless fixed by an update from Qualcomm.

The CVSS score of 7.8 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not in CISA's KEV catalog, but the lack of exploitation data does not mitigate the potential impact. Based on the description, the likely attack vector is an attacker who can influence concurrent requests to the DSP Service, such as through a malicious application or network interface. If exploitable, the attacker could achieve code execution or a denial of service. Because no official patch timestamp is provided, organizations should treat this as a high‑risk issue and prioritize vendor updates or mitigations.