This vulnerability (CVE-2025-59610) is a TOCTOU race condition categorized under CWE-367 affecting Qualcomm Snapdragon products. It occurs during the processing of IOCTL requests when there is a mismatch in API versions, leading to concurrent modification of a user-space buffer and resulting in memory corruption. The issue impacts numerous Snapdragon platforms and related hardware components. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector local, high attack complexity, requiring high privileges, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could lead to memory corruption, potentially allowing an attacker with local high privileges to compromise confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and high privileges, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to affected devices to trusted users with appropriate privileges and monitor for any unusual activity related to IOCTL request handling. Avoid using mismatched API versions in IOCTL requests where possible.