EUVD-2026-36605
GHSA-v64m-phx9-3qqg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local GPU ioctl reachable by any unprivileged process (AV:L, PR:L, AC:L, UI:N); kernel OOB write yields full kernel compromise giving high C/I/A with no scope change.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel.
The product incorrectly indexes internal state when performing sparse allocation remapping.
AnalysisAI
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged process to corrupt kernel memory by issuing crafted GPU sparse memory API calls, enabling privilege escalation to kernel context. Affected releases include Graphics DDK 24.2 RTM and the 25.1 RTM through 25.3 RTM line. No public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%, 5th percentile).
Technical ContextAI
Imagination Technologies' Graphics DDK is the kernel-mode driver stack shipping with PowerVR GPUs used across embedded Linux, Android, and automotive SoCs. The flaw is a CWE-787 out-of-bounds write triggered while the driver remaps sparse GPU allocations; the kernel uses an attacker-influenced index without proper bounds validation, so a malicious userland process can drive the write past the intended buffer in kernel address space. Sparse memory APIs are part of modern GPU virtual memory management (analogous to Vulkan/Direct3D sparse resources), and they are routinely exposed to unprivileged graphics clients, which makes the attack surface broadly reachable on any device using the affected DDK builds (CPE cpe:2.3:a:imagination_technologies:graphics_ddk).
RemediationAI
Patch availability per vendor advisory - upgrade the Graphics DDK to the fixed release identified on Imagination's GPU driver vulnerabilities page (https://www.imaginationtech.com/gpu-driver-vulnerabilities/); exact fixed-build numbers are not enumerated in the provided intelligence, so confirm the target version directly with Imagination or your SoC vendor before rolling out. Because the DDK ships as part of OEM/SoC firmware, end users typically receive the fix through a device or BSP update rather than a standalone driver package, so device makers should integrate the patched DDK into their next platform release. As a compensating control where patching is delayed, restrict execution of untrusted native code on affected devices (e.g., enforce app sandboxing, SELinux 'untrusted_app' confinement, or disable sideloading), since the only known attack path is a local process reaching the GPU IOCTL surface; note this does not protect against malicious code inside otherwise-trusted apps and cannot be applied on devices where third-party software is expected.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today