A high-severity memory safety vulnerability in the Imagination Graphics DDK allows a malicious guest VM to write data outside of its virtualized memory boundaries.

This vulnerability (CWE-823) involves the use of an out-of-range pointer offset when processing commands sent from a Guest VM to the GPU firmware. An attacker with access to a Guest VM can trigger memory writes outside the intended memory region, potentially affecting the host or other virtual machines.

The CVSS score of 7.8 indicates a critical threat to virtualized environments. Exploitation could lead to cross-VM data leakage or host-level compromise, undermining the security guarantees of the virtualization platform and exposing sensitive information to unauthorized actors.

Immediate Action: Upgrade to the Graphics DDK version 26.1 RTM1 or later to resolve the pointer offset error.

Proactive Monitoring: Monitor hypervisor and GPU firmware logs for irregular command sequences or unexpected memory access violations occurring within guest environments.

Compensating Controls: Isolate sensitive virtual machines that utilize GPU acceleration until the patch can be applied, as this reduces the attack surface for potential inter-VM exploitation.

Public Exploit Available: No

This vulnerability represents a serious threat to multi-tenant or virtualized infrastructure. Security teams must ensure that all affected virtualization hosts and guest drivers are updated immediately to prevent potential cross-boundary memory corruption.