A missing bounds check in a media display component allows an out‑of‑bounds write, creating a classic memory corruption flaw identified as CWE‑787. If an attacker already holds System privileges, the flaw can be exploited to overwrite critical memory objects, potentially leading to code execution or further privilege escalation. The vulnerability does not require special user interaction to be triggered.

The flaw affects MediaTek, Inc. chipsets. No specific model or firmware version is listed; all devices using the affected MediaTek display driver are susceptible until the patch is applied.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation in the wild is uncertain. The CVSS score is 6.7. Exploitation requires an adversary to already possess System privileges, indicating that the attack vector is local and privileged. The vulnerability can, however, serve as a foothold for further local attacks once the attacker has escalated privileges. Given the moderate CVSS score and the requirement for existing local privileges, the immediate risk level is moderate but should still be mitigated promptly to prevent potential post‑escalation damage.