EUVD-2026-38002
GHSA-fpwh-r7hr-w6hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain unprivileged local code execution
-
DeliveryOpen GPU device node
-
ExploitIssue crafted GPU syscalls to share memory page
-
ExecutionRace CPU free against GPU FW write
-
PersistReallocate freed page with attacker data
-
ImpactCorrupt kernel state for EoP or DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution as an unprivileged user on a device running an affected Imagination Graphics DDK branch (1.18, 23.2, 24.2, 25.1-25.3, or 26.1 RTM) with access to the PowerVR/IMG GPU device nodes that expose the vulnerable GPU system calls - typical on Android handsets, embedded Linux, and other SoC platforms shipping PowerVR GPUs. Exploitation requires winning a race between the CPU driver freeing a shared memory page and the GPU firmware still writing to it, which limits reliability (SSVC Automatable: no) and is the main practical constraint; no user interaction, network access, or prior privileges beyond ordinary GPU access are required. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H reflects a local, low-complexity, unauthenticated-from-userspace flaw with high integrity and availability impact but no direct confidentiality loss - consistent with a kernel memory-corruption primitive usable for DoS and likely privilege escalation. SSVC reports Exploitation: none and Automatable: no, with Technical Impact: total, so this is not a drop-everything emergency but is a serious local kernel issue once an attacker has code execution as any user. EPSS is not provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the race-condition nature (CPU vs GPU FW timing) likely explains the Automatable: no judgment. The main uncertainty is the absence of a vendor-confirmed fixed-version mapping in the provided data - the EUVD list enumerates affected branches but no patched release is cited. |
| Exploit ScenarioDerived | An attacker who has gained any local unprivileged code execution on an affected device - for example through a malicious app on a PowerVR-based mobile or embedded system - issues a crafted sequence of GPU ioctls that causes the kernel DDK to free a memory page while GPU firmware is still writing to it, then races to reallocate the page with attacker-controlled kernel objects to corrupt kernel state for privilege escalation or to crash the system. No public exploit is identified at time of analysis, and SSVC rates the flaw as not automatable, reflecting the timing race between CPU and GPU firmware that the attacker must win. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Local privilege escalation and denial of service in Imagination Technologies Graphics DDK arises from a write use-after-free between the CPU-side driver and GPU firmware, where the driver frees a shared memory page before the GPU firmware finishes accessing it. Any unprivileged local user able to issue GPU system calls can trigger the race against multiple released DDK branches (1.18, 23.2, 24.2, 25.1-25.3, 26.1). No public exploit identified at time of analysis, but SSVC rates technical impact as total.
RemediationAI
Patch available per vendor advisory - consult Imagination's GPU driver vulnerabilities page at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the fixed DDK revision corresponding to each affected branch (1.18, 23.2, 24.2, 25.1-25.3, 26.1) and coordinate with your SoC vendor or device OEM, since DDK updates typically ship via platform BSPs rather than direct end-user installs. Until a vendor-released patched DDK is deployed, compensating controls are limited because GPU device nodes are normally accessible to all local users; consider restricting access to the PowerVR/IMG render and control device nodes (e.g., /dev/dri/* or vendor-specific /dev/pvr* equivalents) to a trusted GPU group, accepting that this breaks graphics for non-trusted users, and on multi-tenant or kiosk devices avoid running untrusted code locally. Monitor kernel logs for GPU firmware faults or driver oops traces that may indicate exploitation attempts; see also https://vuldb.com/vuln/372345 for tracking.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Imagination Graphics DDK is the Direct Device Kernel driver stack that powers PowerVR/IMG GPUs found in many mobile SoCs, embedded systems, and some automotive/IoT platforms. The flaw is a classic CWE-416 use-after-free, but the lifetime mismanagement crosses an execution boundary: a memory page is owned by the CPU-side kernel driver yet referenced concurrently by GPU firmware running on the GPU's own microcontroller. Because the CPU thread frees the page while the GPU firmware still holds and writes to it, subsequent reallocation lets attacker-controlled data be written into reused kernel-managed memory, a common primitive for kernel privilege escalation when triggered from a userspace process via ioctl-style GPU syscalls.
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local unprivileged user must access GPU device nodes (PR:L) and win a CPU/GPU race (AC:H); kernel memory corruption yields high integrity and availability impact, no direct confidentiality loss.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
2DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario.
A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.
Executive ViewAI
Imagination Technologies Graphics DDK versions 1.18 through 26.1 expose all affected systems to privilege escalation and denial-of-service attacks from unprivileged local users, creating simultaneous risks to security integrity and operational availability. With no patch currently available and total technical impact per SSVC assessment, this vulnerability demands immediate access control mitigations across all affected deployments.
No vendor-released patch identified at time of analysis. Implement privileged execution controls limiting GPU system calls to trusted accounts, restrict local shell access on affected systems, disable non-essential GPU features, and establish monitoring for abnormal GPU driver event patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Exploit-DB