The vulnerability arises from inadequate isolation of the Video Compression Network (VCN) JPEG hardware register space on AMD GPUs, allowing a malicious guest virtual machine or process to read and write the registers of JPEG cores assigned to another VM or process. This can provide arbitrary read/write access to the victim VM or process data, potentially enabling privilege escalation, data theft, or remote code execution.

AMD Instinct MI300A, MI300X, MI308X, MI325X, Radeon PRO W7000 Series, and Radeon RX 7000 Series graphics products are affected according to the vendor notice. No specific firmware or driver version delimiters were provided, so all listed model families should be considered vulnerable until further clarification.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS is not available and the issue is not in the CISA KEV catalog, suggesting no confirmed widespread exploitation, but the lack of adequate isolation means an attacker within a shared host can potentially pivot through the GPU. The likely attack vector is an insider or compromised guest VM that can manipulate GPU register access, so the risk remains significant for virtualization environments that expose shared GPU resources.