This vulnerability (CVE-2025-59614) is classified as CWE-787 (Out-of-bounds Write) and occurs in Qualcomm Snapdragon products. It arises when a random number generator command is sent with an output buffer that is too small, leading to memory corruption. The CVSS 3.1 base score is 6.7 (medium severity) with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected products include various Snapdragon chipsets and components such as Cologne, FastConnect 6900/7800, QCA0000, SC8380XP, WCD9378C/9380/9385, WSA8840/8845/8845H, and multiple X and XG series identifiers. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to memory corruption, potentially allowing an attacker with high privileges and local access to compromise confidentiality, integrity, and availability of the affected device or system. The impact is rated high for confidentiality, integrity, and availability according to the CVSS vector. However, exploitation requires local access and high privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users with high privileges and monitor for any updates from Qualcomm regarding patches or mitigations.