A heap buffer overflow in the wireless LAN component of MediaTek chipsets allows an attacker to perform an out‑of‑bounds write. The vulnerability is triggered without any user interaction and can lead to remote (proximal/adjacent) privilege escalation, granting the attacker higher privileges on the affected device. The flaw is identified as both CWE‑122 (Heap-Based Buffer Overflow) and CWE‑787 (Out‑of‑Bounds Write).

MediaTek chipsets including the MT6890, MT7615, MT7915, MT7916, MT7981, and MT7986 are affected, as well as the MediaTek Software Development Kit. Embedded devices running OpenWrt 19.07.0, 21.02.0, and 23.05.0 that incorporate these chipsets are also susceptible.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely require proximity to the wireless network or adjacent network components to exploit the flaw, possibly through malicious packets or manipulation of wireless management traffic. No additional privileges or user interaction are needed once the vulnerable state is reached.