The vulnerability is an out‑of‑bounds write in the geniezone component due to a missing bounds check. An attacker who has already achieved system privilege can exploit this to modify memory areas outside the intended buffer, allowing local privilege escalation. The vulnerability contains no remote trigger and requires a local presence or prior compromise of system rights; no user interaction is required.

The flaw affects MediaTek, Inc. media chipset firmware, as identified by the vendor. No specific version range is listed, so any firmware build that contains the vulnerable geniezone code may be impacted. Administrators should verify the firmware version and apply updates accordingly.

The CVSS score is 6, the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. Even so, the risk of local privilege escalation remains high once an attacker has system privileges. The exploit would enable an attacker to write to arbitrary memory and can potentially take full control of the device. Immediate patching is recommended to prevent any potential exploitation.