This vulnerability arises from a use‑after‑free condition in the GPU Device Driver Kit (DDK). When an abort command is submitted via PVRSRVRGXKickTA3DKM, a memory buffer that is still being used by the GPU is freed. A non‑privileged application can then allocate a new buffer at the same address and update a shared resource list managed by the driver. The GPU subsequently accesses a memory region that is no longer under driver control, allowing the attacker to read or write arbitrary physical memory. The weakness is a classic use‑after‑free (CWE‑416) and can lead to memory corruption that may compromise confidentiality, integrity, or availability of the system.

Imagination Technologies provides the vulnerable component as part of its Graphics DDK. The vulnerability affects all releases of the GPU DDK that contain this flawed abort‑command handling. No specific version ranges are listed in the CNA data, so any deployment of the Graphics DDK prior to an update that addresses the use‑after‑free is potentially affected.

The flaw can be triggered by a non‑privileged user with the ability to issue GPU system calls; it does not require elevated privileges or network exposure based on the description. Because the exploit manipulates kernel‑space memory controlled by the driver, the difficulty of exploitation is high, but the impact is severe. No EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, its CVE description indicates that the attacker can achieve arbitrary memory reads or writes, which could lead to privilege escalation or denial of service if exploited on a host system that relies heavily on GPU acceleration.