EUVD-2026-23446
GHSA-4h67-fm2h-4qrp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary rating from Vendor (imaginationtech) · only source for this CVE.
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
6DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.
This is caused by improper handling of GPU memory reservation protections.
AnalysisAI
Local privilege escalation in Imagination Technologies Graphics DDK allows low-privileged users to modify read-only GPU memory and files through improper system call handling. Affects DDK versions 1.17 through 25.3 RTM across multiple release branches. Attack requires local access and low-level privileges but no user interaction (CVSS: 7.3). EPSS data not available; no active exploitation confirmed (SSVC: none); no public POC identified at time of analysis. Vulnerability stems from insufficient validation of GPU memory reservation protections, enabling authenticated local users to bypass kernel-enforced memory access controls.
Technical ContextAI
Imagination Technologies Graphics DDK (Driver Development Kit) provides user-mode and kernel-mode components for GPU operations across PowerVR and IMG GPU architectures. This vulnerability (CWE-280: Improper Handling of Insufficient Permissions or Privileges) resides in the GPU system call interface where the driver fails to enforce read-only memory protections during GPU memory reservation operations. When user-mode applications invoke GPU system calls to allocate or manipulate GPU memory regions, the DDK incorrectly grants write permissions to memory segments that should be read-only, including both GPU-mapped user-mode memory buffers and associated filesystem objects. This represents a confused deputy problem where the privileged kernel driver performs operations on behalf of unprivileged callers without proper authorization checks. The affected CPE (cpe:2.3:a:imagination_technologies:graphics_ddk) spans multiple RTM (Release to Manufacturing) branches from legacy 1.17/1.18 versions through current 25.x series, indicating a long-standing architectural flaw rather than a recent regression.
RemediationAI
Upgrade to patched Graphics DDK versions as specified in Imagination Technologies security advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Vendor-released patch details and fixed versions per affected branch should be obtained from that advisory - specific patched version numbers not independently confirmed from available NVD data at time of analysis. For systems unable to immediately patch: restrict GPU device node access permissions (typically /dev/pvr* or /dev/mali* depending on hardware) to trusted user groups only using udev rules; implement mandatory access control policies (SELinux/AppArmor) to prevent untrusted processes from accessing GPU device files; disable GPU acceleration for non-essential applications in multi-user environments. Note that restricting device access will break GPU functionality for affected applications - acceptable trade-off only for non-production or limited-use systems. For containerized environments, explicitly deny GPU device passthrough (--device flag in Docker, devicePlugin in Kubernetes) to untrusted workloads until patching completes. Monitor for abnormal GPU memory allocation patterns via dmesg and system logs. Long-term mitigation requires driver update; workarounds provide only partial risk reduction.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today