The vulnerability is an out‑of‑bounds write in MediaTek’s geniezone component where a missing bounds check could corrupt adjacent memory. An attacker who already has system privilege could exploit this to overwrite critical data, leading to local privilege escalation. The weakness corresponds to CWE‑787.

Affected hardware is any MediaTek chipset that includes the geniezone firmware, as identified by MediaTek’s product security bulletin for June 2026. No specific versions were enumerated, so all current releases that contain the vulnerable implementation are potentially impacted.

The vulnerability does not require user interaction and can be triggered locally. No EPSS or CVSS scores are available, and the issue is not listed in the CISA KEV catalog, indicating no current known exploits. However, given its local privilege escalation nature, any compromised device could leverage it to gain full control.