EUVD-2026-43032
GHSA-54wp-4fgx-pxg4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker runs local unprivileged code (AV:L, PR:L) via straightforward GPU syscalls (AC:L, UI:N); the read/write UAF over reallocated memory yields full C:H/I:H/A:H within an unchanged scope.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping
The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.
AnalysisAI
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user trigger a use-after-free by abusing an integer overflow in GPU memory-mapping system calls. The flaw allows two GPU virtual addresses to alias the same physical page; freeing one mapping releases the page while the second dangling mapping retains read/write access, enabling cross-process memory disclosure and corruption. No public exploit is identified at time of analysis and EPSS is low (0.15%), but the local read/write UAF primitive is a strong stepping stone to kernel-level compromise.
Technical ContextAI
The affected component is Imagination Technologies' Graphics Device Driver Kit (DDK), the kernel/user driver stack for PowerVR-family GPUs embedded in many mobile and embedded SoCs (cpe:2.3:a:imagination_technologies:graphics_ddk). GPU drivers expose ioctl-style system calls that let userspace applications allocate and map GPU memory, translating GPU virtual addresses (device VA) to physical pages. The root cause is CWE-416 (Use After Free), reached through an integer overflow in the mapping path: size/bounds arithmetic wraps, causing the driver to create two distinct GPU virtual mappings that resolve to the same underlying physical page. When one mapping (and its backing physical page) is freed, the driver fails to invalidate the aliased second mapping, leaving a dangling GPU-accessible reference to memory that the kernel or another process can subsequently reallocate.
RemediationAI
Upgrade the Graphics DDK to a fixed release as directed by Imagination's advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; the input data does not list an exact fixed version, so the specific patched build should be taken as vendor-confirmed only once obtained from that advisory (no independently verified fix version is available here). In practice the fix must be delivered through the SoC/device vendor's firmware or OS driver update, so coordinate with the platform vendor for the corresponding patched image. Where patching is not yet possible, compensating controls are limited because the attack originates from any local non-privileged process: reduce the population of untrusted code that can reach the GPU driver (restrict installation/execution of untrusted third-party apps, and where the OS supports it constrain access to the GPU device nodes/ioctl interface via SELinux/sandbox policy), accepting that this can break legitimate GPU-accelerated applications; and monitor for anomalous GPU allocation patterns. These controls narrow, but do not eliminate, exploitability until the driver update is applied.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today