EUVD-2026-36607
GHSA-2m3r-7r37-rw4c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered via web page (AV:N, UI:R), no auth (PR:N); described impact is GPU/browser process crash so A:H with C:N/I:N, and the bug crosses from web content into the GPU driver (S:C).
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
AnalysisAI
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim loads a web page containing crafted WebGPU content into the GLES GPU render process, corrupting memory and crashing the browser or GPU process. The flaw stems from an integer overflow in size calculation driven by untrusted input, which produces an undersized allocation that subsequent writes exceed. EPSS exploitation probability is very low at 0.02% (5th percentile) and no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in the Imagination Technologies Graphics Device Driver Kit (DDK), specifically the user-space portion of the GPU driver stack that handles GLES rendering. WebGPU content rendered by the browser is dispatched to this driver, where untrusted size inputs feed an arithmetic computation. The root cause class is CWE-787 (out-of-bounds write), reached through an integer overflow during memory-size calculation - a classic 'too-small allocation followed by full-size write' pattern. Affected CPE is cpe:2.3:a:imagination_technologies:graphics_ddk where Imagination's PowerVR-family drivers are widely embedded in mobile SoCs and other GPU-accelerated devices, meaning the bug surfaces wherever the DDK's GLES/WebGPU path is reachable.
RemediationAI
Patch availability is not explicitly stated in the input - treat as patch available per vendor advisory and consult https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the specific fixed DDK build matching your platform (no exact fix version was supplied, so do not assume one). Because the DDK is delivered through SoC vendors and device OEMs, end-user remediation typically requires an OS/firmware update from the device manufacturer rather than a direct driver swap. Compensating controls while waiting for a vendor build: disable WebGPU in the browser (e.g. set dom.webgpu.enabled=false in Firefox or the equivalent chrome://flags toggle), at the cost of losing WebGPU-accelerated content; restrict browsing on affected devices to trusted sites via policy or DNS filtering, accepting reduced user freedom; and where feasible force GLES rendering off the affected code path by disabling hardware acceleration, which will increase CPU load and battery use.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today