In the MediaTek imgsys component, improper locking (CWE‑667) and a potential double‑free (CWE‑415) can lead to a memory corruption condition that a local attacker with System privilege could exploit to cause a denial‑of‑service state. The flaw does not require user interaction and can be triggered by the corrupted internal state, rendering the system unresponsive until resolved.

The vulnerability affects MediaTek chipsets MT6897 and MT6989, and is relevant to devices running Android 15.0 that incorporate these chipsets.

The flaw scores a CVSS 5.5 score with a very low exploit probability (EPSS < 1%) and is not listed in CISA’s KEV catalog. Exploitation requires local access with System privilege; an attacker must have already gained elevated rights, after which the flaw can be triggered without further user interaction. The likelihood of widespread exploitation remains low but the impact on affected devices is significant if the attacker succeeds.