A missing bounds check in a MediaTek display handling routine allows an out‑of‑bounds write that can corrupt memory. The defect can be leveraged by a local attacker to elevate privileges, granting an already active process additional system rights. No user interaction is required to trigger the flaw. This control failure manifests as a classic out‑of‑bounds write (CWE‑787).

All MediaTek chipsets listed in the CPE list—including MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8196, MT8678, MT8793—as well as devices running Android 14, 15, and 16 built on these chipsets are susceptible.

The CVSS score of 6.7 indicates a medium security impact, while an EPSS score of less than 1 % points to a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread public exploitation has been documented. An attacker, once able to execute code in the affected environment, can exploit the out‑of‑bounds write to read or modify arbitrary memory, thereby achieving local privilege escalation. The absence of user interaction prerequisites simplifies local exploitation scenarios.