The vulnerability resides in the apusys component of MediaTek chipsets, where a confused deputy flaw can be abused to elevate the privileges of a local attacker. If an actor already has System privilege, the flaw can be triggered without any additional user interaction, granting higher levels of access and potentially full control over the device. The weakness is categorized as CWE-787, indicating a buffer over-read or similar memory corruption issue that permits upward privilege escalation.

Affected products are MediaTek, Inc. MediaTek chipset devices. No specific version or build information was supplied in the advisory; all firmware or software that incorporates the vulnerable apusys module may be at risk.

Because the flaw requires pre‑existing System privileges, exploitation is limited to users who have already compromised the device at a high privilege level. No remote attack vector or user interaction is needed. The CVSS score of 6 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting that widespread, active attacks may not yet be documented. Nonetheless, once the initial compromise is achieved, the flaw permits a rapid elevation of privileges, making the risk significant for any device exposed to local adversaries.