The flaw allows an attacker with control over the Rich Execution Environment (REE) kernel to alter a pointer that the GPU firmware uses when it initializes its core memory. By redirecting this pointer to an attacker‑controlled location, the attacker can corrupt the data the firmware relies on during boot and operation. This could lead to unauthorized manipulation of GPU behavior, potentially enabling covert code execution or denial of service. The weakness is categorized as CWE‑822, which pertains to the handling of non‑trusted memory or pointers.

Imagination Technologies Graphics DDK is affected by this vulnerability. No specific version numbers are listed, so any installation that includes the indicated firmware component could be vulnerable. The vulnerability applies to systems that use a non‑secure operating system on a platform with Trusted Execution Environment support.

Because the vulnerability requires attacker control over the REE kernel, it is an internal or privileged threat; it is not exploitable from an external network context. No EPSS value is available and the item is not listed in the KEV catalog, indicating no publicly known exploit at the time of disclosure. The severity appears high enough that in environments where the REE kernel can be compromised, the attacker could gain significant influence over GPU firmware, leading to potential data tampering or exploitation of the graphics subsystem. The lack of a public exploit mitigates immediate risk, but the possibility of a local privileged attacker remains significant.