The vulnerability resides in the MediaTek imgsys component where a use after free condition can cause a system crash. An attacker with System level privileges can trigger this flaw, resulting in a local denial of service on the affected device. The problem is a classic memory misuse leading to instability rather than information disclosure or code execution.

Affected products include MediaTek chipsets MT2718, MT6899, MT6991, MT8678, and MT8793, which appear in a variety of devices running Google Android 15.0. The CVE entry does not specify any particular firmware or software revision numbers, so any device using the aforementioned chipsets and operating system is potentially vulnerable.

The CVSS score of 4.4 indicates moderate severity, while an EPSS score of less than 1% suggests exploitation is unlikely under normal conditions. The vulnerability is not listed in the CISA KEV catalog. Exfiltration is not necessary; an attacker must already have System privilege to affect the process, so the attack vector is local and requires elevated privileges. A malicious actor could repeatedly trigger crashes to disrupt device operation, but remote exploitation is not possible without local access.