A missing bounds check exists in the MediaTek display subsystem. When an attacker already holds System privilege on a device, exploiting this flaw can raise their privileges further, potentially enabling them to read or write sensitive memory and gain complete control of the device. The vulnerability does not require any user interaction and no remote or network‑based entry point is described.

All MediaTek chipset variants listed in the CVE—MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8196, MT8678, MT8793—are affected. Devices that run Android 14.0, 15.0, or 16.0 firmware containing these chipsets are also impacted, as the display subsystem is embedded in the underlying firmware stack.

The CVSS score of 6.7 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker already possesses System privilege and the flaw is local; no remote or user‑interaction prerequisite is required, making an attack path from an external threat actor unlikely.