This vulnerability (CWE-823) arises from a logic error in the address translation mechanism within Imagination Technologies Graphics DDK. Kernel software running in a virtualized environment can send commands that cause writes outside the intended GPU memory boundaries, enabling arbitrary firmware memory modification by a compromised host kernel. Affected versions include 1.18 RTM, 23.2 RTM, 24.2 RTM, 25.1 RTM, and 26.1 RTM1. No official remediation or patch information is currently available.

The vulnerability allows a compromised host kernel in a VM environment to perform arbitrary writes to GPU firmware memory. This could potentially lead to unauthorized modification of firmware, which may affect GPU operation integrity or security. No known exploits have been reported, and the extent of impact depends on the attacker's ability to leverage this arbitrary write capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting privileged access to the host kernel in virtualized environments and monitoring for unusual GPU firmware behavior where possible.