The flaw resides in MediaTek’s geniezone firmware, where a race condition can trigger an out‑of‑bounds write. This memory corruption can be leveraged by a malicious user who already holds System privilege to gain higher local privileges. The vulnerability does not require user interaction, so it can be triggered by concurrent operations within the firmware.

All MediaTek, Inc. MediaTek chipset devices that deploy the geniezone firmware are affected, regardless of model or firmware version. MediaTek has issued patch ALPS10873936 (Issue ID MSV-6786) to address the race condition.

Because the bug can be exercised locally without remote access or active user involvement, the threat is a purely local privilege escalation. The CVSS score of 6.4 denotes moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue, so the likelihood of widespread attacks remains uncertain, though any device that may already be under local threat actor control poses a high risk.