EUVD-2026-43034
GHSA-cf99-7243-p2v7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged user (AV:L/PR:L) reliably triggers OOB kernel write via GPU API (AC:L), yielding full kernel compromise so C/I/A all High.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.
When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
AnalysisAI
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows a non-privileged local user to corrupt kernel memory through crafted GPU API calls, potentially achieving privilege escalation. The flaw stems from incorrect buffer indexing in the sparse-memory page-freeing path when pages larger than 4kB are handled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already have local code execution as a non-privileged user on a device running the affected Imagination Graphics DDK (PR:L, AV:L), and to be able to invoke the GPU driver's API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) describes a local, low-complexity attack by an already-authenticated low-privileged user yielding high confidentiality, integrity, and availability impact - a classic local kernel privilege-escalation profile, consistent with the description of a non-privileged user triggering OOB kernel reads/writes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised app running as an ordinary unprivileged user on a device with a PowerVR GPU issues crafted GPU API calls that exercise the sparse-memory page-freeing path with pages larger than 4kB. The incorrect buffer index drives an out-of-bounds write into kernel memory, which the attacker shapes to corrupt kernel structures and escalate to full device compromise. … |
| Remediation | Update the Imagination Graphics DDK to a fixed release beyond the affected 24.2 RTM2, 25.1 RTM2-25.3 RTM, and 26.1 RTM1 versions as directed by the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; an exact patched version string is not enumerated in the provided data, so treat the fix as available per vendor advisory and confirm the target build with Imagination or your SoC/device integrator before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of systems running Imagination Technologies Graphics DDK and categorize by deployment criticality and user base size. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Graphics Ddk
View allOut-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Local privilege escalation and memory corruption in Imagination Technologies Graphics DDK (PowerVR GPU driver kit) lets
Improper privilege handling in Imagination Technologies' Graphics DDK GPU driver lets privileged kernel code inside a Ho
Local privilege escalation in Imagination Technologies Graphics DDK (GPU kernel driver) allows non-privileged users to i
Unsafe IOCTL handling in the DDK kernel module allows local attackers with limited privileges to bypass GPU memory prote
Out-of-bounds write in Imagination Technologies' Graphics DDK GPU shader compiler lets a crafted web page containing unu
Local privilege escalation and denial of service in Imagination Technologies Graphics DDK arises from a write use-after-
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today