EUVD-2026-36605
GHSA-v64m-phx9-3qqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local code execution as unprivileged user
-
DeliveryOpen PowerVR GPU device node
-
ExploitIssue crafted sparse memory remap ioctls
-
ExecutionTrigger out-of-bounds kernel write
-
PersistOverwrite kernel credential or page-table structures
-
ImpactEscalate to kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be able to execute code as a local non-privileged user on a device running Imagination Graphics DDK 24.2 RTM or 25.1-25.3 RTM and must have access to the GPU device node exposed to graphics clients (the default on Android and most PowerVR-based Linux/automotive platforms). No user interaction or authentication beyond standard app/user privileges is required, and the trigger is an intentional sequence of GPU sparse memory API ioctls - not a passive condition. Exploitation is limited to platforms that actually ship the affected DDK builds; devices using a different GPU vendor, an older pre-24.2 DDK, or a vendor-patched downstream driver are not in scope, and the published CVSS AV:N rating appears incorrect since the description requires local code execution. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is inconsistent with the description, which clearly describes a local non-privileged process invoking a kernel GPU IOCTL - AV should almost certainly be Local, not Network, dropping the realistic base score to roughly 7.8. EPSS is very low (0.02%, 5th percentile), there is no CISA KEV listing, and no public PoC is referenced, so this is currently not an opportunistically exploited bug. Real-world risk is nevertheless meaningful on devices running affected PowerVR drivers (notably Android handsets and embedded SoCs) because any sandboxed app or attacker-supplied native code can reach the vulnerable API to attempt kernel privilege escalation; treat it as a high-priority local LPE primitive rather than a remote network threat. |
| Exploit ScenarioDerived | A user installs a seemingly benign Android game or runs a malicious native binary on an embedded Linux/automotive device using a vulnerable PowerVR driver; the process opens the GPU device node and issues a sequence of sparse memory map/remap ioctls with crafted indices, triggering the out-of-bounds kernel write. The attacker uses the controlled write to overwrite kernel structures (e.g., cred or page tables) and elevates to root/kernel, escaping the app sandbox. No public exploit identified at time of analysis, but the bug class is well understood and historically weaponized against mobile GPU drivers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged process to corrupt kernel memory by issuing crafted GPU sparse memory API calls, enabling privilege escalation to kernel context. Affected releases include Graphics DDK 24.2 RTM and the 25.1 RTM through 25.3 RTM line. No public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%, 5th percentile).
RemediationAI
Patch availability per vendor advisory - upgrade the Graphics DDK to the fixed release identified on Imagination's GPU driver vulnerabilities page (https://www.imaginationtech.com/gpu-driver-vulnerabilities/); exact fixed-build numbers are not enumerated in the provided intelligence, so confirm the target version directly with Imagination or your SoC vendor before rolling out. Because the DDK ships as part of OEM/SoC firmware, end users typically receive the fix through a device or BSP update rather than a standalone driver package, so device makers should integrate the patched DDK into their next platform release. As a compensating control where patching is delayed, restrict execution of untrusted native code on affected devices (e.g., enforce app sandboxing, SELinux 'untrusted_app' confinement, or disable sideloading), since the only known attack path is a local process reaching the GPU IOCTL surface; note this does not protect against malicious code inside otherwise-trusted apps and cannot be applied on devices where third-party software is expected.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Imagination Technologies' Graphics DDK is the kernel-mode driver stack shipping with PowerVR GPUs used across embedded Linux, Android, and automotive SoCs. The flaw is a CWE-787 out-of-bounds write triggered while the driver remaps sparse GPU allocations; the kernel uses an attacker-influenced index without proper bounds validation, so a malicious userland process can drive the write past the intended buffer in kernel address space. Sparse memory APIs are part of modern GPU virtual memory management (analogous to Vulkan/Direct3D sparse resources), and they are routinely exposed to unprivileged graphics clients, which makes the attack surface broadly reachable on any device using the affected DDK builds (CPE cpe:2.3:a:imagination_technologies:graphics_ddk).
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local GPU ioctl reachable by any unprivileged process (AV:L, PR:L, AC:L, UI:N); kernel OOB write yields full kernel compromise giving high C/I/A with no scope change.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
2DescriptionCVE.org
Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel.
The product incorrectly indexes internal state when performing sparse allocation remapping.
Executive ViewAI
Imagination Technologies Graphics DDK (PowerVR GPU driver) versions 24.2 RTM through 25.3 RTM contain an out-of-bounds kernel write vulnerability (CVSS 8.8) enabling local privilege escalation to kernel context. While no public exploit identified at time of analysis and exploitation probability is negligible (0.0% EPSS), organizations deploying affected GPU drivers expose local users to potential kernel compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict GPU sparse memory API access to trusted processes; enforce user privilege controls to limit local code execution; implement kernel monitoring for suspicious GPU API activity; isolate high-value systems; contact Imagination Technologies for updated or alternative GPU driver releases with remediations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Exploit-DB