Imagination Technologies Graphics DDK CVE-2026-34193

Exploitation requires the attacker to operate at Host kernel level within a Guest/Host VM environment where the affected Imagination Technologies Graphics DDK (versions 1.18 RTM, 23.2 RTM, 24.2 RTM, 25.1-25.3 RTM, or 26.1 RTM1) is installed and active. The CVSS AV:A (Adjacent Network) vector confirms that the attacker must share the same logical GPU memory space or hypervisor adjacency layer - direct internet-based exploitation is not possible without first achieving this co-location. No authentication is required (PR:N) once adjacent access is present, and no user interaction is needed (UI:N). Exploitation is strictly limited to systems using Imagination Technologies PowerVR GPU hardware with DDK-based virtualization; deployments using other GPU vendors or non-virtualized configurations are unaffected. The CVSS Scope:Unchanged (S:U) indicates the impact is contained within the GPU firmware memory boundary rather than escaping to the hypervisor or host OS.

The CVSS 4.3 Medium score is driven by AV:A (Adjacent Network), which substantially limits the exploitable population to attackers sharing the same logical GPU memory or hypervisor boundary - this is not remotely exploitable from the internet without first achieving co-tenancy or hypervisor-level adjacency. PR:N indicates no privileges are required once adjacent access is established, and AC:L reflects low complexity at that point. The integrity impact is scored Low (I:L) with no confidentiality or availability impact, yet the CVE tags include both 'Information Disclosure' and 'Memory Corruption' - a discrepancy that warrants vendor clarification, as arbitrary firmware writes could in practice exceed the Low integrity score in sensitive GPU virtualization deployments. No EPSS score was provided, and no KEV listing exists, indicating no confirmed widespread or active exploitation. The Chrome OS advisory reference confirms patch availability through at least one major platform update cycle, suggesting the vendor has treated this with urgency despite the moderate CVSS score.

An attacker operating at the kernel level within a co-tenant or adjacent VM in a shared GPU virtualization environment crafts malformed GPU firmware commands using the compromised Host kernel driver. The address translation logic error fails to constrain the firmware write target, causing the GPU firmware to write attacker-influenced data to arbitrary firmware memory addresses outside its intended allocation. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward for any attacker who has already achieved kernel access within the relevant adjacent GPU environment.