A use‑after‑free bug in the MediaTek apu component can corrupt memory, allowing a local attacker to gain elevated privileges without needing to execute arbitrary code. The flaw does not require user interaction, and the attacker does not acquire additional execution privileges beyond those of the compromised process.

The vulnerability affects MediaTek, Inc. chipsets; specific firmware or product versions are not disclosed.

Because the weakness can be triggered by a local user, exploitation is straightforward once the attacker can run code on the device. No public exploit or proof‑of‑concept code is known, and the EPSS score is not available, so the likelihood of exploitation remains uncertain. However, the CVE is not listed in the CISA KEV catalog, and the CVSS score of 8.4 indicates high severity.