EUVD-2026-43034
GHSA-cf99-7243-p2v7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged user (AV:L/PR:L) reliably triggers OOB kernel write via GPU API (AC:L), yielding full kernel compromise so C/I/A all High.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.
When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
AnalysisAI
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows a non-privileged local user to corrupt kernel memory through crafted GPU API calls, potentially achieving privilege escalation. The flaw stems from incorrect buffer indexing in the sparse-memory page-freeing path when pages larger than 4kB are handled. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis and EPSS is low at 0.17% (6th percentile).
Technical ContextAI
The affected component is Imagination's Graphics DDK (Driver Development Kit), the kernel-mode/user-mode driver stack that services PowerVR GPUs in mobile and embedded SoCs. The vulnerability lives in the DDK's sparse memory implementation, where GPU memory can be mapped in non-contiguous pages. During page-freeing logic, when a page size larger than 4kB is used, the code computes an incorrect index into the tracking buffer, producing an out-of-bounds access. Because GPU drivers process these API calls in kernel context, the defect maps to CWE-787 (Out-of-Bounds Write) and directly touches privileged kernel memory rather than a sandboxed user buffer.
RemediationAI
Update the Imagination Graphics DDK to a fixed release beyond the affected 24.2 RTM2, 25.1 RTM2-25.3 RTM, and 26.1 RTM1 versions as directed by the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; an exact patched version string is not enumerated in the provided data, so treat the fix as available per vendor advisory and confirm the target build with Imagination or your SoC/device integrator before deployment. Because the DDK ships inside device firmware, in practice this means applying the OS/vendor driver update that incorporates the corrected DDK. As a compensating control where patching lags, restrict the ability of untrusted or low-trust local applications to reach the GPU driver API (for example, tighten app allowlisting, sandboxing, or SELinux/seccomp policies around the GPU device nodes); the trade-off is that overly restrictive GPU access policies can break legitimate graphics or compute workloads, so validate against required apps first.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today