A missing bounds check in the GNSS component of MediaTek chipsets can allow an out‑of‑bounds write, leading to a local denial of service. The flaw does not grant additional privileges and requires the user to interact with the device to trigger the exploit, making it a local attack vector.

The affected party is MediaTek, Inc., specifically its chipsets used in consumer electronics. No specific versions or CPE identifiers are listed, so all current implementations of the GNSS firmware could be vulnerable unless an update has been applied.

The exploit is limited to local users with physical access and does not enable remote code execution or privilege escalation. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalogue, indicating a lower likelihood of widespread exploitation. The absence of a CVSS score and the requirement for user interaction suggest that the risk to end users is moderate but still significant enough to warrant timely remediation.