An integer overflow in the HEVC decoder can cause an out‑of‑bounds write, allowing a malicious actor who already possesses system privileges to take control of the device. The vulnerability is a classic example of CWE‑787. No user interaction is required for exploitation; the flaw can be triggered by crafted media data processed by the decoder.

MediaTek chipsets are affected. No specific chipset model or firmware version was disclosed in the advisory, so all MediaTek devices using the affected decoder code are potentially vulnerable.

The CVE is not listed in CISA’s KEV catalog, but its EPSS score is <1%, indicating a very low but nonzero likelihood of exploitation. The CVSS score of 6.5 reflects a moderate severity. An attacker already possessing system‑level access must supply malicious HEVC streams to the decoder; they could corrupt memory and elevate privileges. The exploitation path is likely local or remote over a network interface that accepts media streams, and it does not require any user interaction.