EUVD-2026-36607
GHSA-2m3r-7r37-rw4c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious WebGPU page
-
DeliveryVictim visits page in browser
-
ExploitCrafted WebGPU content sent to GLES render process
-
ExecutionInteger overflow in DDK size calculation
-
PersistOut-of-bounds write in GPU user-space driver
-
ImpactMemory corruption and GPU/browser process crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must browse to attacker-controlled content using a browser whose GLES render process is backed by an Imagination Technologies Graphics DDK in one of the affected RTM trains (1.18, 23.2, 24.2, 25.1-25.3, or 26.1), with WebGPU enabled and routed through the GPU process. Exploitation is therefore limited to devices shipping Imagination/PowerVR GPU drivers (common on certain mobile/embedded SoCs, uncommon on desktop), and requires the user-interaction step of loading the malicious page despite the CVSS vector marking UI:N. Devices with WebGPU disabled, hardware acceleration off, or non-Imagination GPU stacks are not exposed via this path. |
| Impact | Signals conflict sharply. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) implying trivial unauthenticated remote compromise, but the description makes clear exploitation requires a victim to load a malicious web page into a browser using the affected DDK - that is functionally UI:R and the realistic outcome described is a crash, not full C/I/A:H code execution. EPSS is 0.02% (5th percentile) and there is no KEV listing and no public exploit identified at time of analysis, consistent with the bug being a memory-corruption primitive that has not been demonstrated to yield reliable RCE. The honest read is a real but lower-priority browser/GPU stability flaw with theoretical escalation potential on Imagination-GPU devices; the CVSS vector overstates impact relative to the description. |
| Exploit ScenarioDerived | An attacker hosts a web page with crafted WebGPU shaders and buffer descriptors that drive the size-calculation path into integer overflow. A victim on an Imagination/PowerVR-GPU device visits the page, the GLES render process passes the malformed sizes into the DDK, and the resulting out-of-bounds write corrupts adjacent memory and crashes the GPU/browser process - with potential, unproven, escalation to code execution in the GPU process context. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim loads a web page containing crafted WebGPU content into the GLES GPU render process, corrupting memory and crashing the browser or GPU process. The flaw stems from an integer overflow in size calculation driven by untrusted input, which produces an undersized allocation that subsequent writes exceed. EPSS exploitation probability is very low at 0.02% (5th percentile) and no public exploit identified at time of analysis.
RemediationAI
Patch availability is not explicitly stated in the input - treat as patch available per vendor advisory and consult https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the specific fixed DDK build matching your platform (no exact fix version was supplied, so do not assume one). Because the DDK is delivered through SoC vendors and device OEMs, end-user remediation typically requires an OS/firmware update from the device manufacturer rather than a direct driver swap. Compensating controls while waiting for a vendor build: disable WebGPU in the browser (e.g. set dom.webgpu.enabled=false in Firefox or the equivalent chrome://flags toggle), at the cost of losing WebGPU-accelerated content; restrict browsing on affected devices to trusted sites via policy or DNS filtering, accepting reduced user freedom; and where feasible force GLES rendering off the affected code path by disabling hardware acceleration, which will increase CPU load and battery use.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the Imagination Technologies Graphics Device Driver Kit (DDK), specifically the user-space portion of the GPU driver stack that handles GLES rendering. WebGPU content rendered by the browser is dispatched to this driver, where untrusted size inputs feed an arithmetic computation. The root cause class is CWE-787 (out-of-bounds write), reached through an integer overflow during memory-size calculation - a classic 'too-small allocation followed by full-size write' pattern. Affected CPE is cpe:2.3:a:imagination_technologies:graphics_ddk where Imagination's PowerVR-family drivers are widely embedded in mobile SoCs and other GPU-accelerated devices, meaning the bug surfaces wherever the DDK's GLES/WebGPU path is reachable.
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered via web page (AV:N, UI:R), no auth (PR:N); described impact is GPU/browser process crash so A:H with C:N/I:N, and the bug crosses from web content into the GPU driver (S:C).
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
2DescriptionCVE.org
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
Executive ViewAI
Imagination Technologies Graphics DDK contains a critical integer overflow enabling out-of-bounds memory writes when users load web pages with malicious WebGPU content, risking browser and GPU process crashes. Although the vulnerability has high severity (CVSS 9.8), no public exploit has been identified at time of analysis, and current exploitation probability is very low (0.02% EPSS). The absence of a vendor-released patch requires immediate implementation of interim controls and monitoring.
Disable WebGPU in affected browsers via policy or Content Security Policy headers; implement network controls to restrict user access to untrusted web content; establish GPU process crash detection and alerting; monitor vendor security channels for patch release; isolate high-risk user populations from WebGPU-capable browsers if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Exploit-DB