Imagination Graphics DDK CVE-2026-45195

Exploitation requires the attacker to already be running kernel-mode software inside the Host VM (i.e., local, kernel/driver-level privileges on the host - reflected by AV:L and PR:L), and the target system must use one of the affected Graphics DDK versions (1.18, 23.2, 24.2, 25.1-25.3, or 26.1 RTM) with a GPU firmware path that accepts host-kernel-supplied addresses without re-validating them against the host kernel's permitted range. Limiting factors: it is not remotely reachable and cannot be triggered by an unprivileged user - the attacker must first obtain host-kernel execution - and no user interaction is involved. It is therefore a privilege/isolation-boundary escalation usable only by an already-privileged local actor, most impactful in virtualized or multi-tenant GPU deployments where untrusted code may run in the Host VM.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) describes a local attack of low complexity requiring some privileges and no user interaction, with high confidentiality, integrity and availability impact - consistent with code that already runs as kernel software inside the Host VM abusing the GPU firmware path. There is no EPSS score, KEV listing, or POC in the provided data, so all current signals point to local exploitation by an already-privileged actor rather than remote or mass exploitation; this is a privilege/isolation-boundary weakness, not an internet-facing RCE. One tension worth flagging: the description's effect - firmware accessing host memory beyond what the host kernel is permitted - arguably represents a security-scope change (the impacted authority extends past the attacker's own component), which could justify S:C and a higher score than the recorded S:U/7.8. Treat this as a real local-privilege/VM-isolation priority in virtualized or multi-tenant GPU deployments, but lower urgency where only trusted code runs in the Host VM.

An attacker who has already achieved kernel-level code execution inside the Host VM (for example via a separate local privilege escalation or as a malicious/compromised driver) crafts GPU command stream entries containing memory addresses outside its permitted range. The GPU firmware accepts these addresses and performs reads or writes using its more privileged memory access, letting the attacker exfiltrate or corrupt host memory it should not reach. No public POC is identified, and the low attack complexity means a knowledgeable attacker with the required local privileges could reliably trigger it.