This vulnerability arises from the reuse of a static initialization vector (nonce) in AES-GCM key wrapping within Qualcomm Snapdragon products. AES-GCM requires a unique nonce for each encryption operation to maintain cryptographic security. Reusing the nonce can lead to serious cryptographic failures, potentially allowing attackers to compromise the confidentiality and integrity of encrypted data. The affected products include specific Snapdragon chip versions such as QCA6696, QDU1000 series, QDX1010 series, QXM1093 series, WCD9380 series, WCN3950 series, WSA8830 series, and XRV7209 series. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating local attack vector with low complexity and low privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation of this vulnerability can lead to compromise of the confidentiality and integrity of encrypted data processed by the affected Snapdragon products. The reuse of a nonce in AES-GCM encryption undermines the cryptographic strength, potentially allowing attackers to decrypt or manipulate protected data. There is no reported impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published by Qualcomm as of the current information. Users and integrators of affected Snapdragon products should monitor Qualcomm's advisories for updates. Until a fix is available, avoid relying on affected cryptographic operations if possible or implement compensating controls at higher layers if feasible.