A high-severity use-after-free vulnerability in Imagination Technologies Graphics DDK allows local users with low privileges to execute improper GPU system calls, potentially leading to total system compromise.

This issue is an incomplete cleanup flaw categorized under CWE-459, triggered via improper GPU system calls requiring low privileges and local access.

A successful exploit permits unprivileged memory access from shader code, leading to potential data compromise, unauthorized modification, and system instability. With a CVSS score of 7.8, this high-severity flaw threatens environments where untrusted local code execution is possible, such as multi-tenant or shared workstations.

Immediate Action: Update Imagination Technologies Graphics DDK to version 26.1 RTM2 or later.

Proactive Monitoring: Monitor system and GPU driver logs for anomalous error paths or repeated failure codes within the MMU mapping logic.

Compensating Controls: Restrict local user access and prevent the execution of untrusted shader code or unverified binaries on vulnerable systems.

Public Exploit Available: No (no confirmed public exploit exists in our tracked sources).

Administrators must prioritize updating the Graphics DDK to the fixed release as soon as possible. Because local execution vectors can be leveraged in chained attacks, applying the vendor patch remains the most critical step to neutralize the risk of unauthorized physical memory access.