EUVD-2026-13834
GHSA-2mc2-45rp-r4w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious web page with GPU shader code
-
DeliveryLoad page triggering GPU compiler
-
ExploitTrigger out-of-bounds write in shader compiler
-
ExecutionCrash compiler process with system privileges
-
ImpactEnable further system exploitation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must open a web page containing malicious GPU shader code in a browser on a platform where the GPU compiler process runs with system privileges. Requires crafted shader code with large switch statement values to trigger out-of-bounds write in GPU shader compiler. |
| Impact | The real-world risk is elevated despite missing CVSS and EPSS scores due to several factors: the vulnerability is memory-corruption-based (CWE-823), which historically correlates with exploitability; the attack vector is network-based (malicious web page), requiring minimal user interaction; and the technical impact is significant on systems where the GPU compiler process holds system privileges, potentially enabling code execution or privilege escalation. However, the absence of a public proof-of-concept, KEV listing, or CVSS vector limits confidence in immediate exploitation likelihood. The vulnerability's reliance on triggering an edge case (very large switch values) and platform-specific privilege escalation prerequisites suggests this is a real but not trivial vulnerability. Organizations should prioritize patching based on their GPU hardware (Imagination Technologies GPUs are found in specific SoCs) and threat model, with higher priority for systems where GPU processes run privileged. |
| Exploit ScenarioDerived | An attacker crafts a malicious website containing WebGL or WebGPU code with a shader that includes a switch statement with an exceptionally large numeric value. When a user visits the site, their browser submits the shader to the GPU compiler process for compilation. The compiler's boundary checks fail on the large switch value, triggering an out-of-bounds write that crashes the compiler process. On systems where the GPU compiler runs as a system service or with elevated privileges, this memory corruption could be leveraged to achieve code execution or privilege escalation, potentially compromising device security. No public proof-of-concept is currently known, but the simplicity of the triggering condition (large switch value in shader code) suggests weaponization is feasible once details are disclosed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with elevated privileges, affecting multiple platforms through crafted switch statements that trigger out-of-bounds writes. An attacker can exploit this vulnerability by delivering specially-crafted GPU shader code through a web page, potentially gaining system-level control on vulnerable devices. No patch is currently available for this critical vulnerability.
Earlier versions of this analysis (1)
A memory corruption vulnerability exists in Imagination Technologies' Graphics DDK GPU shader compiler that can be triggered when a maliciously crafted web page containing unusual GPU shader code with extremely large values in switch statements is processed. An attacker can cause an out-of-bounds write (segmentation fault) in the compiler process; on platforms where the compiler runs with system privileges, this could enable privilege escalation or further device exploitation. No CVSS score, EPSS data, or active KEV status is currently available, but the vulnerability affects the Graphics DDK library across unspecified versions.
RemediationAI
Apply patches provided by Imagination Technologies for the Graphics DDK as detailed in their security advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. For device manufacturers and OEMs using this DDK, integrate the patched compiler library into updated GPU driver builds and firmware. Until patches are available or deployed, mitigate exposure by restricting WebGL and WebGPU functionality on untrusted content through browser sandbox policies, disabling GPU acceleration for untrusted web pages, or enforcing Content Security Policy to limit shader code sources. Administrators should prioritize patching for devices where GPU compiler processes run with elevated privileges.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Imagination Technologies' Graphics DDK (Driver Development Kit), specifically in the GPU shader compiler library that processes GLSL or similar shader code. The root cause is classified as CWE-823 (Use of Out-of-Bounds Pointer), manifesting as an out-of-bounds write during the compilation of shader code containing edge-case switch statement constructs with very large numeric values. When a web page embeds or references GPU shader code (via WebGL, WebGPU, or similar APIs), the shader is submitted to the GPU compiler process for compilation. The compiler fails to properly validate or bound-check large values in switch statements, leading to a write beyond allocated buffer boundaries. The affected CPE is cpe:2.3:a:imagination_technologies:graphics_ddk:*:*:*:*:*:*:*:*, indicating all versions of the Graphics DDK are potentially affected until patched.
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
Executive ViewAI
Organizations using A web page that face critical risk from CVE-2026-21732 rated CVSS 9.6. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Exploit-DB