The flaw in the Imagination Technologies Graphics DDK occurs in RGXDerivePTEProt8, where incorrect flag validation fails to enforce write restrictions on GPU memory reservation. This allows a process running as a non‑privileged user to issue GPU system calls that obtain write permission for memory that is normally read‑only, such as shared libraries (e.g., libc.so). The lack of proper validation and authorization lets the attacker overwrite protected portions of user‑mode memory and files, potentially compromising the integrity of the process and the operating system.

Imagination Technologies Graphics DDK is the affected component. No specific version numbers are provided in the advisory, so any installation of the Graphics DDK that includes the RGXDerivePTEProt8 function could be impacted. Administrators should contains this code or if a later release includes a fix.

The CVSS score of 7.3 indicates a high severity level, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The description reveals that a non‑privileged user can cause memory corruption by gaining write access to read‑only regions; this represents a local privilege escalation scenario that can disrupt process integrity or lead to code execution. Based on the nature of GPU driver deployment, it is inferred that the flaw could be exploitable on operating systems that support Imagination GPUs, such as Linux or Android, although explicit platform support is not stated.