This vulnerability is a use‑after‑free error in the display subsystem that can corrupt memory. The defensive effect is that a malicious actor who already has System level access could abuse the corruption to elevate privileges locally. The flaw does not require user interaction and does not provide remote exploitation capabilities.

Affected hardware includes a broad range of MediaTek chipsets such as MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8186, MT8188, MT8196, MT8667, MT8673, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8791t, MT8792, MT8793, MT8795t, MT8796, MT8798, MT8873, MT8883. Android operating system versions 14.0, 15.0, and 16.0 are also impacted as they run on these chipsets.

The CVSS score of 6.7 indicates a medium threat level. The EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires local access to a device with System privileges; therefore, the risk is significant mainly for devices that have already been compromised or accessed by a privileged user. Exploitation would involve triggering the memory corruption in the display driver to achieve privilege escalation. It is unclear whether publicly available exploit code exists; the flaw does not provide a direct path to remote code execution.