The vulnerability is an out-of-bounds write caused by type confusion in the VENC subsystem. This flaw can corrupt memory when the VENC module processes data, and an attacker who already has system privilege can exploit it to gain higher privileges. No user interaction is required for exploitation, and the flaw is local to a device running the affected firmware.

The issue affects MediaTek chipsets that include the VENC module. The vendor has identified the flaw with patch ID ALPS11383899 and issue ID MSV-9606. No specific firmware version information is listed.

The CVE is not listed in CISA KEV, and no EPSS score is available, so the exploit probability cannot be quantified. A CVSS severity score of 6.7 is provided, indicating a moderate severity. However, because the vulnerability enables local privilege escalation for attackers who already hold system privileges, its risk remains high for any compromised system. The attack vector is local, no network or remote access is required.