EUVD-2026-48746
GHSA-hw4h-9c69-9q35
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (imaginationtech) · only source for this CVE.
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.
AnalysisAI
Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.
More in Graphics Ddk
View allOut-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today