The vulnerability is a double free in the _FreeOSPages function of the Imagination Technologies Graphics DDK, caused by an incorrect allocation flag set by _EncodeAllocationFlags. A non‑privileged user can issue a malformed IOCTL call that creates a specific allocation scenario, and when that allocation is freed it triggers a double free, corrupting the kernel heap. The kernel heap corruption can lead to arbitrary code execution with elevated privileges, effectively turning a low‑privilege user into a kernel‑mode attacker. This flaw is a classic memory corruption issue represented by CWE‑416.

Imagination Technologies Graphics DDK. No specific affected version information is provided in the CVE data, so any installation of the Graphics DDK should be considered potentially vulnerable until a patch is released.

The CVE has no EPSS score listed and is not included in the CISA KEV catalog, so current exploit likelihood is unknown. Given the nature of the flaw – a double free leading to kernel heap corruption – the potential impact is severe if exploited. The vulnerability is triggered via an improper IOCTL call, so an attacker does not need elevated privileges to exploit it. Because no official patch or workaround is cited in the provided data, the security control balance currently relies on delaying or limiting access to the vulnerable driver interface.