Mesa ImGui SetDragDropPayload Integer Truncation

Executive Summary

Executive Summary

A critical integer truncation vulnerability exists in the Mesa ImGui SetDragDropPayload function used by [REDACTED] Tier-1 Hypervisor’s 3D acceleration subsystem. The vulnerability allows a guest VM to trigger a heap-based buffer overflow in the host kernel.

The flaw occurs when processing drag-and-drop payload sizes that exceed 32-bit integer boundaries. The hypervisor truncates the size value, leading to undersized memory allocation followed by out-of-bounds writes.

Technical Details

The vulnerable code path:

1. Guest submits ImGui drag-drop command with large payload size
2. Size parameter is truncated from 64-bit to 32-bit
3. Hypervisor allocates buffer based on truncated size
4. Guest writes full payload, overflowing the heap

Affected Versions

• All versions with Mesa ImGui integration
• Primarily affects 3D-accelerated guest workloads
• High impact in cloud environments with GPU passthrough

Remediation

Vendors are implementing proper integer overflow checks and using 64-bit size validation throughout the rendering pipeline.

OPSEC Note

Detailed exploitation mechanics and proof-of-concept code are embargoed until patches are publicly available.