The vulnerability is an untrusted pointer dereference that occurs when the graphics engine processes draw objects of an incorrect type during command list execution. This flaw can corrupt memory, potentially allowing an attacker who supplies malformed graphics commands to execute arbitrary code or cause a denial of service. The weakness is a classic case of unvalidated input leading to memory corruption as identified by CWE-822.

This issue affects Qualcomm, Inc. Snapdragon devices. No specific firmware or driver version numbers are listed, so any model using the Snapdragon graphics stack is potentially impacted until an official vendor fix is released.

With a CVSS score of 7.8, the vulnerability is considered high severity. No EPSS value is available and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting that exploitation has not been observed publicly. The attack likely requires an attacker to control the data sent to the graphics pipeline, such as through a malicious application or an exploited driver, making the vector more specialized and less probable than a universal exploit. Nonetheless, the high impact warrants monitoring and proactive mitigation.