EUVD-2026-70858
GHSA-49pq-rgj7-q6mh
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Kernel access within guest required (AV:L/PR:L); TOCTOU race justifies AC:H; description's explicit write capability crossing VM GPU memory boundary warrants S:C/I:L over vendor's S:U/I:N.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory.
The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.
AnalysisAI
Out-of-bounds GPU memory access in Imagination Technologies Graphics DDK allows kernel-level code executing inside a Guest VM to read from, and potentially write to, GPU memory regions outside its allocated virtualized address space via a TOCTOU race condition in GPU firmware validation. Affected versions span multiple DDK release trains including 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1-25.3 RTM, and 26.1 RTM1 as enumerated in EUVD-2026-70858. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires prior kernel-level code execution within a Guest VM that has access to Imagination Technologies GPU hardware through a virtualization layer (GPU SR-IOV partitioning, pass-through, or equivalent firmware-mediated sharing). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 2.5 (Low) reflects AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - local access, high attack complexity due to the race condition, low privileges within the guest kernel, no user interaction, unchanged scope, and only confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Imagination Technologies GPU driver vulnerabilities advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ to identify patched DDK builds for each affected release train - fixed DDK versions are not independently confirmed from the available reference data and must be obtained directly from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today