A use‑after‑free bug in the MediaTek apusys component could corrupt memory and is identified as a memory corruption vulnerability. If triggered, the flaw can elevate restrictions for an attacker who already holds System privilege, effectively allowing local privilege escalation. The weakness is categorized as CWE‑416, indicating unsafe deallocation and reuse of memory. This issue is limited to local attackers who can interact with the affected system and does not require user interaction to exploit once the initial System privilege is present.

The flaw exists in MediaTek, Inc. chipsets that implement the apusys component. No specific firmware or hardware revisions are enumerated in the advisory; the vulnerability applies across all versions of MediaTek chipsets that include this component.

The CVSS score of 6.7 indicates a medium severity for local privilege escalation. The lack of EPSS data means the exploitation likelihood cannot be quantified, but the flaw requires an attacker with System privilege to trigger the memory corruption, and no user interaction is needed once that prerequisite is met. The vulnerability is not listed in CISA's KEV catalog, yet a local privileged actor could use it to gain higher privileges and broader control over the device.