In Imagination Technologies Graphics DDK, the function rgxfw_to_ptr() fails to reject firmware private data pointers, allowing a kernel running inside a Guest virtual machine to instruct the GPU firmware to write data outside the Guest’s allocated virtualised GPU memory. This out‑of‑bounds write can overwrite arbitrary memory locations, which an attacker with kernel privileges inside the Guest can use to alter the host or other virtual machines, effectively enabling privilege escalation.

All installations of Imagination Technologies Graphics DDK that contain the rgxfw_to_ptr() routine are potentially vulnerable. No specific version numbers are disclosed, so any release of the Graphics DDK that includes this function should be considered at risk.

Because exploitation requires attacker control of kernel code within a Guest VM, the threat is limited to environments where a malicious VM can run privileged code. No EPSS or KEV data is available; the CVSS score is not supplied. The vulnerability can be leveraged to perform out‑of‑bounds writes that may compromise the host or other VMs, making the risk significant in multi‑tenant or shared‑hardware scenarios.