A use‑after‑free flaw exists in MediaTek's AIDL implementation, allowing an attacker with system privilege to corrupt memory and achieve local privilege escalation. The weakness is a classic use‑after‑free scenario labeled CWE-416, and no user interaction is required for an exploit. If triggered, the attacker can gain higher privileges within the device, potentially executing arbitrary code as root.

The flaw affects MediaTek chipsets that incorporate the vulnerable AIDL code. No specific models or firmware revisions are enumerated, so all MediaTek chipset variants containing this code path are potentially impacted. The vendor references a patch identified as ALPS11242428 and an issue ID MSV‑9038.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood is undetermined. The CVSS score of 6.7 indicates a moderate severity, and the local privilege escalation nature combined with the lack of user interaction indicates a moderate risk for devices already running with system privileges. Prompt application of the vendor fix is strongly advised to mitigate this risk.