EUVD-2026-35082
GHSA-j38r-mp7c-vxww
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (imaginationtech) · only source for this CVE.
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
By creating resources of certain types and presenting a set of parameters to the affected interface the exploit can be used to corrupt kernel memory.
AnalysisAI
Kernel heap memory corruption in Imagination Technologies Graphics DDK allows a non-privileged local user to crash or destabilize the kernel by issuing crafted GPU system calls. The flaw affects Graphics DDK 24.2 RTM, 25.1 RTM through 25.3 RTM, and 26.1 RTM, and impacts any device shipping the affected PowerVR/IMG GPU driver stack. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Imagination Technologies' Graphics DDK is the kernel-mode driver stack that ships with PowerVR/IMG GPUs found in many Android handsets, automotive infotainment systems, set-top boxes, and other embedded devices. The vulnerability is a CWE-122 heap-based buffer overflow reachable through the GPU ioctl/system-call interface exposed to userland: when an unprivileged process creates particular resource types and passes a specific parameter combination, the driver mis-sizes or mishandles an allocation in the kernel heap, allowing controlled corruption of adjacent kernel objects. Because graphics ioctls are intentionally exposed to non-root applications to allow rendering, the attack surface is large.
RemediationAI
Patch available per vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; consult Imagination's GPU driver vulnerabilities page for the specific fixed DDK release that supersedes 24.2 / 25.x / 26.1 RTM, then coordinate with the SoC vendor or OEM to obtain a BSP update incorporating that fix, since end devices rarely consume DDK directly. Exact fixed version was not enumerated in the supplied data and should be confirmed against the vendor page. Compensating controls are limited because the GPU device node must remain accessible to unprivileged apps for rendering to work; on managed Android/embedded fleets, restrict installation of untrusted third-party applications via MDM and use SELinux/AppArmor profiles to deny GPU ioctls to high-risk processes (trade-off: breaks hardware-accelerated graphics for those processes), and on attended kiosks/automotive units disable sideloading.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today