The flaw is a 32‑bit integer overflow that occurs in the kernel mode driver during page‑to‑byte conversion of an allocation size. The overflow under‑allocates a kernel buffer, allowing the driver to map either unallocated or previously freed physical pages into an attacker‑controlled GPU MMU context. The result is a disclosure of sensitive kernel memory data to the user that already has non‑privileged access to the system. The entry specifically labels this weakness as 0‑day integer overflow (CWE‑190).

Imagination Technologies Graphics DDK is the only vendor listed. No specific affected versions are provided, so all releases prior to a future patch that corrects the overflow are potentially vulnerable.

The vulnerability can be exploited from user‑land without needing elevated privileges, assuming the vulnerable driver is loaded and the attacker can invoke the offending API calls. No current EPSS score is available and the issue is not in the CISA KEV catalog, indicating it has not yet been widely abused publicly. Nonetheless, the potential to read protected kernel memory makes the risk significant, and the lack of a patch means administrators should treat this as a high‑severity exposure until a remediation is released.