The vulnerability is an out‑of‑bounds write in the MediaTek MAE (Media Access Engine) due to a missing bounds check, which can allow a local attacker who already possesses System privileges to elevate their privileges further. This flaw is an example of a buffer overflow (CWE-1285) and an out‑of‑bounds write (CWE-787). The description states no user interaction is required, indicating that exploitation can occur on the local machine after initial local access has been achieved.

MediaTek chipsets MT2718, MT6899, MT6991, MT8678, and MT8793, as well as devices running Android 15.0, are potentially affected. Specific version information is not provided.

The CVSS score of 6.7 indicates medium severity. The EPSS probability of less than 1% reflects a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, further suggesting limited active exploitation. Attackers would need local System‑level access to exploit this flaw, making it a local privilege escalation vector; user interaction is not required.