A driver provided by TOSHIBA CORPORATION and Dynabook Inc. exposes an IOCTL with insufficient access control, allowing a logged‑in user without administrative privilege to read arbitrary physical memory. The flaw, identified as CWE‑782, permits extraction of sensitive data such as passwords or cryptographic keys, leading to a confidentiality breach. No write or execution privileges are granted by the driver, so the issue does not enable direct code execution.

The Generic IO & Memory Access driver for PCs from TOSHIBA CORPORATION and Dynabook Inc. is affected. All PC models that ship with this driver are potentially vulnerable; no specific version information is provided.

The CVSS score of 6.8 indicates moderate severity. No EPSS data is available, so the likelihood of exploitation is unknown, but the flaw can be leveraged by any local user who is logged in. The vulnerability is not listed in the CISA KEV catalog. It represents a local attack vector that can compromise confidentiality by reading physical memory.