CVE-2026-49745 is a vulnerability in the Imagination Technologies Graphics DDK where kernel software inside a Guest VM can issue improper commands to the GPU firmware. These commands trigger writes outside the bounds of the Guest's virtualized GPU memory, leading to out-of-bounds memory access. This flaw corresponds to CWE-823 (Use of Out-of-range Pointer Offset) and can be exploited to escalate privileges within the Guest VM environment. The vulnerability has a CVSS v3.1 base score of 7.8, indicating high severity. No affected versions or patch information are currently provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with limited privileges inside a Guest VM to perform out-of-bounds memory writes to the GPU firmware memory space. This can result in privilege escalation, potentially compromising the integrity and confidentiality of the virtualized environment. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict untrusted code execution inside Guest VMs and monitor for suspicious GPU command activity if possible.