The vulnerability is a use‑after‑free in the GPU pdma driver of MediaTek chipsets, which allows a local attacker to obtain higher privileges on the device without needing to execute code in privileged context or interact with a user. This flaw can lead to full control of the system, enabling manipulation of data, installation of malware, and other actions that compromise integrity and confidentiality.

The flaw affects MediaTek, Inc.'s chipsets. Any device that uses a MediaTek chipset with the unpatched GPU pdma implementation is vulnerable. Version details are not listed in the advisory, so all current releases prior to the patch identified by ALPS11365070 should be considered at risk.

The exploit requires a local attacker and no user interaction, indicating a high attack surface for administrators and technicians. With no EPSS score available, there is limited insight into current exploitation activity, but the lack of user interaction and the nature of privilege escalation imply that the risk is significant. The flaw is not included in CISA's KEV catalog, yet its potential impact warrants immediate remediation.