An out‑of‑bounds read has been found in the Wi‑Fi firmware of MediaTek chipsets. The flaw arises from a missing bounds check, allowing an attacker that already holds system‑level privileges to read memory beyond the intended buffer. This can expose sensitive data stored in the chip’s memory. No user interaction is required to exploit the vulnerability, making the attack feasible for a local adversary with elevated privileges.

The affected products are MediaTek chipsets that include the vulnerable Wi‑Fi stack. Firmware patches identified as ALPS10960006, BORA00155314, BORA00155001, and BORA00154907 address the issue. No specific firmware version numbers are provided, but any device using MediaTek Wi‑Fi firmware prior to these patches is potentially impacted.

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1 %, indicating limited data on exploitation probability. The CVSS score of 5.5 indicates a medium severity. The flaw requires the attacker to already possess system privileges, limiting the likely attack surface to local or privileged adversaries. Nevertheless, when this condition is met, the attacker can read confidential information, compromising the confidentiality of the device. Based on the available information, the risk is moderate, but it is significant enough to warrant patching.