A use‑after‑free bug in the DSP Service causes memory corruption when handling user input buffers, potentially allowing an attacker to execute arbitrary code. The weakness is classified as CWE‑416, indicating a classic memory reuse error. Abuse of this flaw could lead to system compromise or denial of service if an attacker can provide crafted input to the vulnerable routines.

Qualcomm Snapdragon devices contain the vulnerable DSP Service. No specific firmware or OS versions are listed, so any Snapdragon chip running the service could be affected. The vendor is Qualcomm, Inc.; the product model is referred to simply as Snapdragon in the CVE description.

The CVSS score of 7.8 places the vulnerability in the high severity range, suggesting significant impact if exploited. EPSS data is not available, so the likelihood of weaponized exploitation cannot be assessed from the current data. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation incidents. The attack vector is not explicitly documented; however, given that the flaw occurs in system service routines, exploitation would likely require the ability to supply input to the DSP Service, either locally or remotely through a service interface. The risk to impacted devices remains moderate to high until a vendor fix is applied.