The vulnerability resides in MediaTek's Audio HAL where a use‑after‑free condition allows a process that already has System level privileges to manipulate dangling pointers, potentially rising its own privilege level. The flaw does not grant arbitrary code execution on its own; it is limited to local privilege escalation for an attacker who already has substantial device access. The impact is confined to the device’s integrity and the potential to bypass the current privilege boundaries within the local context.

Affected vendors: MediaTek, Inc. Product: MediaTek chipset. No specific firmware or software version was supplied in the advisory. Consequently, all MediaTek chipsets that include the legacy Audio HAL implementation remain potentially vulnerable until a patch is applied.

The CVSS score of 6.7 indicates a medium severity local issue, but the use‑after‑free flaw combined with the lack of user interaction requirement and the prerequisite of System privileges make it a significant risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Once an attacker has System rights, exploitation is relatively straightforward, emphasizing the importance of applying the vendor‑issued fix as soon as possible.