A critical integer overflow vulnerability in Imagination Technologies Graphics DDK enables unauthenticated attackers to perform unauthorized memory access and potential code execution.

The vulnerability is an integer overflow (CWE-190) occurring during the calculation of physical offsets for sparse Physical Memory Regions (PMRs). This flaw allows an unauthenticated, non-privileged user to trigger a 32-bit truncation, leading to incorrect GPU Memory Management Unit (MMU) mappings and resulting in unintended physical memory access.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity due to its potential for full system compromise. Successful exploitation allows for memory corruption or information disclosure, which could lead to unauthorized data access, system instability, or the execution of arbitrary code with the privileges of the GPU driver.

Immediate Action: Update the Imagination Technologies Graphics DDK to version 26.1 RTM2 or later, as these versions contain the necessary fix for the integer overflow.

Proactive Monitoring: Monitor system logs for unusual GPU driver crashes or kernel-level errors that may indicate attempts to exploit memory management functions.

Compensating Controls: Ensure that systems utilizing affected drivers are isolated from untrusted networks, and employ hardware-level security features like IOMMU where possible to restrict memory access.

Public Exploit Available: Unknown

Given the critical CVSS severity and the low complexity of the attack vector, this vulnerability represents a significant risk to system integrity. Administrators should prioritize patching the Graphics DDK across all deployed environments to prevent potential memory exploitation.