This vulnerability involves a use of out-of-range pointer offset (CWE-823) in the Graphics DDK by Imagination Technologies. Specifically, kernel software inside a guest VM can post improper commands to the GPU firmware, triggering writes outside the guest's allocated virtual GPU memory. Such out-of-bounds memory access can be exploited by malware introduced to the guest kernel mode driver to escalate privileges and break out of the virtualized environment. The CVSS v3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. No patch or remediation information is currently provided by the vendor.

Successful exploitation allows an attacker with limited privileges inside a guest VM to perform out-of-bounds writes to GPU memory, potentially leading to privilege escalation and escape from the virtualized environment. This compromises the isolation between guest and host, threatening the confidentiality, integrity, and availability of the host system and other guests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict untrusted code execution within guest VMs and monitor for suspicious GPU command activity. No vendor-provided mitigation or workaround information is currently available.