The vulnerability in Mediatek’s WLAN Station driver arises from a missing bounds check, allowing an attacker to perform an out‑of‑bounds write. This defect can be exploited to gain higher privileges on the device, provided the attacker already holds standard user execution rights on the system. No additional user interaction is required, meaning the flaw can be leveraged purely locally.

Devices with Mediatek chipsets—including the MT7902, MT7920, MT7921, MT7922, MT7925, and MT7927—are impacted, as are systems utilizing the Mediatek nbiot_sdk. The vulnerability is specific to the WLAN STA driver within these components.

With a CVSS score of 7.8 the flaw is considered high severity, yet the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog, but the combination of local escalation and the lack of user interaction makes it a serious risk for any system with an exposed Mediatek WLAN STA driver. An attacker would need user execution privileges on the device and would then trigger the out‑of‑bounds write to elevate those privileges without further input.