Technical impact
In the MediaTek chipset’s apu component, insufficient input validation can corrupt memory. An attacker who can supply malicious input may trigger this corruption, enabling a local escalation of privilege without needing additional execution privileges. The flaw is a classic memory corruption vulnerability (CWE‑1285) and, according to the description, requires no user interaction to be exploited.
Affected Systems
The affected product is the MediaTek chipset produced by MediaTek, Inc. All releases containing the apu component are potentially impacted until the patch ALPS11249004 is applied. No specific version range is provided, so every firmware build with the apu component should be considered vulnerable.
Risk and Exploitability
The CVSS score of 8.4 indicates a high severity, and there is no EPSS score available, which suggests limited public exploitation data. The vulnerability is not listed in CISA’s KEV catalog, and it is local; it requires the attacker to already be on the device with the ability to provide arbitrary input. The flaw allows a local escalation of privilege without requiring additional execution privileges, and no user interaction is necessary.
