The vulnerability arises from an unchecked ui32TracePointer parameter in the rgxfw_log_ex() function of Imagination Technologies' Graphics DDK. Because the parameter is not validated, the Guest Kernel Mode Driver (KMD) can cause the GPU firmware to write data outside the memory space allocated for the VM. This out‑of‑bounds write permits code execution in the host context, effectively allowing an attacker inside the Guest to escape the virtualised environment and gain higher privileges. The flaw is a functional weakness (CWE‑823) involving insecure boundary checks during memory operations.

Imagination Technologies Graphics DDK. No version information is provided in the advisory; all releases that include the rgxfw_log_ex() function are potentially affected.

The CVSS score of 7.8 indicates a high severity. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of exploitation. However, the impact of a successful exploit is substantial, as it would allow an attacker to escape the isolation between guest and host. The lack of an official patch in the advisory means that the risk remains until vendor releases a fix or the host is hardened. Attackers would need the ability to load a malicious Guest KMD or inject crafted commands, so the attack vector typically requires VM kernel driver manipulation.