EUVD-2026-26663CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system.
AnalysisAI
Use-after-free in Imagination Graphics DDK GPU GLES user-space library allows authenticated remote attackers to crash the GPU render process via crafted WebGPU content. CVSS 8.1 (High) with network vector and low complexity. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running Imagination Graphics DDK versions 1.18, 23.2, 24.1, 24.2, 25.1, 25.2, or 25.3; audit which systems expose WebGPU capabilities to untrusted users or networks. Within 7 days: Implement network-level restrictions to limit WebGPU content delivery from untrusted sources; disable WebGPU APIs where operationally feasible; document GPU process privilege levels on affected systems. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today