The flaw resides in the ccci component of MediaTek chipsets where a bounds check is omitted, enabling an out‑of‑bounds write and read. An attacker who already holds System privilege and can interact with the device may seize local information, corrupt memory, or trigger crashes. If the corrupted memory is leveraged correctly, privilege escalation to higher levels can also be achieved. The impact is confined to systems where the vulnerable ccci binaries are loaded and an attacker has local system access, as no remote exploitation path is described.

MediaTek chipsets MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988, MT2735, and MT2737 are affected. Patches are available under patch identifiers ALPS11428950 (for MT6880, MT6890), ALPS10563453 (for MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988), and AUTO00858766 (for MT2735, MT2737).

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the publicly reported likelihood of exploitation remains undefined. Nevertheless, the absence of a remote entry requirement and the need for local System privilege reduce the attack surface. An attacker with existing local access could exploit the buffer overrun to read or write unintended memory locations, but would have to trigger the vulnerable code path through user interaction. The CVSS score of 6.7 indicates a medium severity, and the potential for privilege escalation or data leakage means that the risk remains significant if the conditions are met.