In the MediaTek MAE component, a race condition can trigger an out‑of‑bounds write. The write can corrupt memory and grant a local attacker additional privileges if the attacker has already obtained system‑level access. No user interaction is required for exploitation.

The vulnerability affects devices that incorporate several MediaTek chipsets, including MT2718, MT6899, MT6991, MT8168, MT8169, MT8186, MT8188, MT8678, MT8695, MT8696, and MT8793. Android 15 running on these chipsets is also affected.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% shows a very low likelihood of public exploitation. The flaw is listed as not being in the CISA KEV catalog. Exploitation requires local presence and pre‑existing system privilege, with no requirement for user interaction. Attackers with system rights could use the race condition to write beyond array bounds and elevate privileges further.