Qualcomm DSP Service Untrusted Pointer Dereference Vulnerability Allowing Memory Corruption

A vulnerability has been identified in the Qualcomm DSP Service that allows for memory corruption. This issue arises during an Escape call when an invalid Kernel Mode CPU event and synchronization object handle are provided, with the DriverKnownEscape flag disabled. The vulnerability is present in various chipsets, including those used in automotive and mobile platforms.

Impact

Exploitation of this vulnerability leads to memory corruption, which can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Qualcomm has released patches for this vulnerability. Instructions for applying the patch can be found in the Qualcomm March 2025 Security Bulletin.