Kernel software running inside a Host VM can post improper commands to the GPU Firmware, allowing the firmware to read or write memory addresses beyond the privileged range allocated to the host kernel. This flaw, identified as CWE-280, can enable an attacker with kernel-level access to the host to perform arbitrary memory reads or writes, potentially leading to kernel code execution or privilege escalation.

The vulnerability resides in Imagination Technologies Graphics DDK used in the GPU driver stack. Affected versions are not listed in the advisory, so any installation of the Graphics DDK remains potentially vulnerable until a patch is applied.

The CVSS score is 7.8 and the EPSS score is unavailable, but the nature of the flaw indicates a high risk for attackers who can control kernel code within the host VM. Exploitation would require the ability to craft and inject the specific GPU commands that trigger the out‑of‑bounds accesses. No KEV listing suggests no publicly known exploits yet, but the potential for privileged memory access creates a serious threat that warrants immediate attention.