Technical impact
The vulnerability is an out‑of‑bounds write in the vdec component of MediaTek chipsets due to a missing bounds check. This flaw is a type of buffer overflow (CWE‑787) that can be exploited to elevate privileges on the host system without requiring extra execution privileges. The flaw can be triggered remotely, but the attacker must interact with a user to initiate the exploit.
Affected Systems
The affected product is MediaTek chipsets that include the vdec subsystem. No specific revision or firmware version is listed, so the vulnerability may apply to any MediaTek device running the susceptible vdec code until patched.
Risk and Exploitability
Because the flaw enables remote privilege escalation, the risk is high for any device that can be accessed remotely. The exploit requires user interaction, which reduces likelihood of automated attacks. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 8.8 confirms a high severity. The presence of a patch ID (ALPS11383899; MSV‑9614) indicates that a vendor fix exists and should be applied promptly to eliminate the risk.
