This vulnerability involves an out-of-bounds write (CWE-787) in the secure boot process of MediaTek chipsets MT2737, MT6880, MT6890, and MT6990. The heap buffer overflow can be exploited locally by an attacker with physical access to escalate privileges. Exploitation does not require user interaction or prior execution privileges. Patch identifiers are noted (AUTO00845351 for MT2737 and ALPS11072643 for MT6880, MT6890, MT6990), but no official remediation level or patch availability is confirmed in the advisory.

Successful exploitation could lead to local privilege escalation on affected devices, potentially allowing an attacker with physical access to gain higher privileges than intended. There is no indication of remote exploitation or need for user interaction. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has referenced patch IDs related to this issue, but no official fix or remediation level is stated in the available data. Until an official patch is confirmed, restrict physical access to affected devices to mitigate risk.