In Imagination Technologies Graphics DDK, the function rgxfw_to_ptr() fails to reject firmware private data pointers, allowing a kernel running inside a Guest virtual machine to instruct the GPU firmware to write data outside the Guest’s allocated virtualised GPU memory. This out‑of‑bounds write can overwrite arbitrary memory locations, which an attacker with kernel privileges inside the Guest can use to alter the host or other virtual machines, effectively enabling privilege escalation.

All installations of Imagination Technologies Graphics DDK that contain the rgxfw_to_ptr() routine are potentially vulnerable. No specific version numbers are disclosed, so any release of the Graphics DDK that includes this function should be considered at risk.

Based on the description, it is inferred that exploitation requires attacker control of kernel code within a Guest VM, so the likely attack vector is a malicious VM running privileged code. The EPSS score is < 1% and KEV is not listed; the CVSS score is 7.8. The vulnerability can be leveraged to perform out‑of‑bounds writes that may compromise the host or other VMs, making the risk significant in multi‑tenant or shared‑hardware scenarios.