The vulnerability lies in a missing bounds check within the MediaTek geniezone component, which can allow an attacker who already possesses system‑level privileges to elevate them further or modify system resources. This flaw is categorized as CWE‑125 and enables local privilege escalation without user interaction, potentially granting the attacker full control over the affected system.

The affected product is the MediaTek chipset running the geniezone component. No specific firmware or software version information is provided in the advisory, so all installations based on MediaTek's geniezone should be considered at risk until confirmed patches are applied.

The EPSS score is < 1%, indicating a very low probability of current exploitation. The CVSS score of 6.7 reflects a moderate severity issue, and the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been observed. However, because exploitation requires an attacker to already have system privileges and no user interaction is necessary, the risk is contingent on an initial compromise. The advisory includes a patch ID (ALPS10724073) that addresses the issue, reducing risk once applied.