The vulnerability resides in the geniezone component of MediaTek chipsets. A race condition can result in an out‑of‑bounds write, allowing a malicious actor who already possesses System privilege to gain higher local privileges. The flaw does not require user interaction and can be triggered by concurrent operations within the firmware.

This flaw affects MediaTek, Inc. MediaTek chipset devices that deploy the geniezone firmware, regardless of the particular model or firmware version. The vendor has identified the defective code and released patch ALPS10873936 (Issue ID MSV-6786) to address the race condition.

Because the bug can be exercised locally without remote access or user action, the threat profile is a local privilege escalation. No EPSS or KEV data are available, and the CVSS rating has not been published, so the likelihood of exploitation in the wild is uncertain. Operators should consider the risk high for devices that could already be under local control by a threat actor.