Technical impact
In the MediaTek Geniezone component, a missing bounds check permits an out‑of‑bounds write. If an attacker can execute code with System privileges, this defect allows the attacker to overwrite adjacent memory, potentially modifying control data or other sensitive structures. The flaw can be used to elevate privileges further within the local system, but it does not grant network or remote access by itself.
Affected Systems
The vulnerability affects MediaTek, Inc. chipsets that incorporate the Geniezone component. No specific firmware versions are listed, so all affected MediaTek devices running this component are potentially vulnerable until remedied.
Risk and Exploitability
The exploit requires that the attacker already possess System or higher privileges on the device, meaning it is a local privilege escalation vector and user interaction is not needed. The CVSS score is 6, and the EPSS score is <1%, with the vulnerability not listed in KEV. Nonetheless, once privilege is reached, the impact is severe, enabling arbitrary code execution or further privilege escalation within the system. The risk is high for environments where devices run unpatched firmware or are accessible to malicious users with local access.
