EUVD-2026-39785
GHSA-c5qr-j92g-m289
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local GPU compiler is the attack surface (AV:L) but the victim must load a malicious web page (UI:R); no auth needed (PR:N); memory corruption yields high integrity/availability impact, no data disclosure (C:N).
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.
AnalysisAI
Out-of-bounds write in Imagination Technologies' Graphics DDK GPU shader compiler lets a crafted web page containing unusual or edge-case shader code (e.g. WebGL/compute shaders using a very small value) corrupt memory and crash the GPU compiler process. On platforms where that compiler process runs with system privileges, the memory corruption could be chained toward privilege escalation or further device exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; impact is integrity and availability (CVSS 7.7, CWE-823).
Technical ContextAI
Imagination Technologies' Graphics DDK is the GPU driver/development kit underpinning PowerVR-class GPUs shipped in many mobile and embedded SoCs. The flaw lives in the shader compiler library, which parses and compiles GPU shader programs (the kind a browser submits via WebGL/WebGPU) inside a dedicated GPU compiler process. CWE-823 (Use of Out-of-range Pointer Offset) is the root cause class: an edge-case shader input - described as using a very small value - drives the compiler to compute a pointer/index outside the intended bounds and perform an out-of-bounds write, producing a segmentation fault and exploitable memory corruption. The affected component is identified by CPE cpe:2.3:a:imagination_technologies:graphics_ddk and tagged Buffer Overflow / Memory Corruption.
RemediationAI
Apply the fixed Graphics DDK release from Imagination Technologies as distributed by your SoC/device vendor; consult the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the corrected RTM version applicable to your DDK branch (25.x, 24.x, 23.2, or 1.18), as no single exact fix version was provided in the input - Patch available per vendor advisory, released patched version not independently confirmed here. Until the updated driver is integrated, the most effective compensating control is to limit untrusted shader compilation reaching the GPU compiler: disable or restrict WebGL/WebGPU in browsers on affected devices (trade-off: breaks hardware-accelerated 3D and some web apps), and avoid loading untrusted web content on devices where the GPU compiler process runs with elevated/system privileges. Where the platform allows, reduce the privilege level of the GPU compiler process so a crash cannot escalate (trade-off: possible performance or compatibility regressions).
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same weakness CWE-823 – Use of Out-of-range Pointer Offset
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today