The vulnerability is a missing permission check in MediaTek’s AIDL interface, which allows a malicious local actor that already has System privilege to elevate their privileges further. The flaw does not require any user interaction and can be exploited by re‑using the existing authorization state. This type of weakness maps to Missing Authorization (CWE‑862).

The affected devices are those containing MediaTek chipsets. No specific firmware or driver versions are listed, so all devices using the impacted MediaTek AIDL component are potentially vulnerable until updated.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, which limits publicly available exploitation data. However, because the flaw enables local privilege escalation via an unchecked permission, the potential impact is significant for systems that run untrusted or partially trusted code with System privileges. The likely attack vector is a local user or process with existing System access, which could then take on higher privileges or compromise the system integrity by bypassing intended access controls.