EUVD-2026-39787
GHSA-hwpp-2m5q-2cw8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel-level access in the Host VM gives AV:L/PR:L; firmware accessing host memory beyond the host kernel's permitted range crosses an authority boundary, justifying S:C with full C/I/A impact.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
AnalysisAI
Improper privilege handling in Imagination Technologies' Graphics DDK GPU driver lets privileged kernel code inside a Host VM submit crafted commands to the GPU firmware, coercing the firmware into reading or writing host memory outside the range the host kernel is permitted to touch. Affecting Graphics DDK 1.18, 23.2, 24.2, 25.1-25.3 and 26.1 RTM, the flaw enables out-of-bounds host memory access (information disclosure and corruption) through the firmware's elevated memory privileges. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the local code-execution impact (CVSS 7.8) makes it a meaningful local privilege/boundary-bypass concern.
Technical ContextAI
The Imagination Graphics DDK is the kernel-mode driver stack that mediates between host/guest operating systems and PowerVR-class GPU hardware and its onboard firmware. GPUs accept command streams that reference memory addresses; in a properly isolated design the firmware must validate that addresses supplied by host kernel software stay within ranges that kernel is authorized to access. This vulnerability is classed as CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the firmware honors addresses passed by the host kernel and performs the access using the firmware's own, more privileged view of memory, so the permission level enforced by the system for the host kernel is not re-applied at the firmware boundary. The CPE cpe:2.3:a:imagination_technologies:graphics_ddk identifies the affected component as the DDK driver software rather than a specific SoC, and the 'Information Disclosure' tag reflects the read-side impact, though the description explicitly covers writes as well.
RemediationAI
No exact fixed version is provided in the input, so the actionable step is to consult Imagination's GPU driver vulnerability advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ and obtain the patched Graphics DDK build from your SoC/platform integrator, prioritizing systems running the listed 1.18, 23.2, 24.2, 25.1-25.3 and 26.1 RTM releases (the '≤25.3 RTM' boundary suggests a fix exists in a later 25.x build, but the patched version is not independently confirmed from available data). Until a vendor build is applied, compensating controls focus on shrinking who can run privileged code in the Host VM: restrict host-kernel/driver-loading privileges to trusted operators, avoid exposing the GPU command interface to untrusted guests or workloads, and where the deployment allows it, gate or disable GPU passthrough/virtualization features for untrusted tenants - accepting the trade-off of degraded or unavailable GPU acceleration for those workloads. These controls do not remove the underlying firmware-side validation gap.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today