CVE-2024-47895

High

Published: 13 January 2025

Published

13 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Score 0.0003 10.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-47895 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates CVE-2024-47895 by requiring timely identification, prioritization, and patching of the vulnerable Imagination Technologies GPU driver in virtualized environments.

SI-16 Memory Protection good match

prevent

Enforces memory protection mechanisms to prevent guest kernel software from posting improper commands that enable out-of-bounds reads in virtualized GPU memory.

SC-4 Information in Shared System Resources good match

prevent

Prevents unauthorized information transfer via shared GPU memory resources exploited by improper commands from the guest VM kernel to GPU firmware.

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.

Confidence: LOW · MITRE ATT&CK Enterprise v18.1

NVD Description

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.

Deeper analysisAI

CVE-2024-47895 affects Imagination Technologies GPU drivers, specifically where kernel software running inside a Guest VM posts improper commands to the GPU Firmware. This flaw enables reading data outside the Guest's virtualized GPU memory, classified under CWE-823 (Access of Uninitialized Pointer). The vulnerability received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and was published on 2025-01-13.

A local attacker with low privileges inside the Guest VM can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows high-impact confidentiality violations by accessing data beyond the virtualized GPU memory boundaries, potentially exposing sensitive information from the host or other guests, alongside high availability impacts that could disrupt GPU operations.

Imagination Technologies has published details on mitigations and patches for this and related GPU driver vulnerabilities at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this advisory for specific remediation steps tailored to affected driver versions in virtualized environments.