The vulnerability is an out‑of‑bounds write in MediaTek’s geniezone component where a missing bounds check could corrupt adjacent memory. An attacker who already has system privilege could exploit this to overwrite critical data, leading to local privilege escalation. The weakness corresponds to CWE‑787.

Affected hardware is any MediaTek chipset that includes the geniezone firmware, as identified by MediaTek’s product security bulletin for June 2026. No specific versions were enumerated, so all current releases that contain the vulnerable implementation are potentially impacted.

The vulnerability does not require user interaction and can be triggered locally. The CVSS score of 7.8 classifies it as a high‑severity threat. EPSS data is not available, so the exploitation likelihood cannot be quantified. The issue is not listed in the CISA KEV catalog, so there are no known public exploits. However, because it allows local privilege escalation, any device where an attacker already has system‑level access could leverage it to gain full control.