CVE-2026-45199: CWE-823: Use of Out-of-range Pointer Offset (4.16) in Imagination Technologies Graphics DDK

This vulnerability involves the use of out-of-range pointer offsets (CWE-823) in the Graphics DDK by Imagination Technologies. Kernel software inside a Guest VM can issue commands to the GPU firmware that cause writes beyond the allocated virtual GPU memory boundaries. Such out-of-bounds memory writes can be exploited to escalate privileges within the guest environment. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and requiring low privileges.

Successful exploitation allows an attacker with kernel-level access inside a Guest VM to perform out-of-bounds memory writes to the GPU firmware memory space. This can lead to privilege escalation within the virtualized environment, compromising confidentiality, integrity, and availability of the guest system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time.