EUVD-2026-43039
GHSA-5xwh-rf6v-6cj6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L because exploitation is local via the GPU command interface, and PR:H because it requires attacker-controlled kernel software inside the Host VM; high C/I/A from privilege escalation across the GPU boundary.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.
AnalysisAI
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM to post malformed commands to the GPU firmware, forcing an improper GPU register access that can be leveraged to gain elevated privileges. The flaw (CWE-280, improper handling of permissions) affects multiple DDK release branches from 1.18 through 26.1 and is rated CVSS 7.8 (local, low complexity). There is no public exploit identified at time of analysis, and its EPSS probability is low (0.14%).
Technical ContextAI
The Graphics DDK (Driver Development Kit) is Imagination Technologies' kernel-mode driver stack for its PowerVR-family GPUs, which are embedded in numerous mobile and embedded SoCs. The vulnerability lives at the boundary between host/guest kernel driver code and the GPU firmware: privileged kernel software running inside a Host VM submits commands to the firmware, and insufficient validation of those commands lets a caller trigger a GPU register access it should not be permitted to perform. This maps to CWE-280 (Improper Handling of Insufficient Permissions or Privileges) - the firmware/driver command interface fails to enforce the privilege boundary between the requesting kernel component and the register operations exposed by the GPU. Per the CPE (cpe:2.3:a:imagination_technologies:graphics_ddk), the affected component is the Graphics DDK software itself rather than a specific hardware part.
RemediationAI
Update the Imagination Graphics DDK to a fixed release for your branch as published by the vendor; consult the Imagination GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the patched build corresponding to your DDK line (1.18, 23.2, 24.2, 25.x, or 26.1). Patch available per vendor advisory - no single cross-branch fix version is enumerated in the available data, so device and SoC integrators should obtain the corrected DDK build from Imagination and roll it into firmware/OS updates. Where immediate patching is not possible, the primary compensating control is to restrict which kernel components and VMs are permitted to submit commands to the GPU firmware: in virtualized deployments, limit GPU passthrough/virtualization to trusted guests only and avoid exposing the GPU command interface to untrusted or multi-tenant Host VMs (trade-off: reduced GPU acceleration for those guests). Also minimize the set of local principals that can load kernel modules or run privileged code on affected hosts, since exploitation requires local kernel-level access. Track the downstream device vendor's firmware update for the fixed DDK, as the correction must be delivered through their build.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today