EUVD-2026-33627
GHSA-9j5v-4c6x-8694
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (imaginationtech) · only source for this CVE.
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.
A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.
AnalysisAI
Arbitrary firmware memory writes in Imagination Technologies Graphics DDK affect multiple DDK versions across Guest/Host VM deployments. A logic error in GPU driver address translation permits kernel-level software within a VM to issue malformed commands to GPU firmware, causing writes to memory regions outside the intended GPU memory boundary. The Chrome OS stable channel advisory reference confirms real-world platform-level impact, and a vendor patch is available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Imagination Technologies Graphics DDK (Driver Development Kit) is the software stack enabling operating systems and hypervisors to interface with PowerVR GPU hardware, commonly deployed in mobile, embedded, and ChromeOS devices. The affected component is identified by CPE cpe:2.3:a:imagination_technologies:graphics_ddk across all examined versions. CWE-823 (Use of Out-of-range Pointer Offset) describes a defect where pointer arithmetic produces an address outside the intended memory region - here, during address translation between the Guest/Host VM memory space and GPU firmware memory. When the Host kernel driver constructs GPU firmware commands, the translation layer fails to properly constrain the target address, allowing crafted commands to reference and write to arbitrary firmware memory locations outside the GPU's intended allocation.
RemediationAI
Apply the vendor-released patch from Imagination Technologies' GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ - the exact fixed DDK version number is not independently specified in the available data and must be confirmed directly from the vendor advisory. Chrome OS users should apply the stable channel update documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-chromeos_01312344978.html. As a compensating control prior to patching, operators of GPU-accelerated virtualization environments should restrict which VMs are granted GPU passthrough or shared GPU memory access, limiting the pool of potential adjacent-access attackers - note this may reduce GPU workload density. Additionally, monitoring GPU firmware command queues for anomalous write patterns can provide detection capability; however, this requires vendor tooling support and may not be available on all platforms.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-823 – Use of Out-of-range Pointer Offset
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today