EUVD-2026-63811
GHSA-4p5h-7mq4-j3p9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requiring guest kernel privileges (PR:L, AV:L); no interaction needed; full C/I/A impact; scope unchanged pending confirmed hypervisor escape.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.
AnalysisAI
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires kernel-level (ring-0) code execution inside a Guest VM - the CVSS PR:L reflects that the attacker must already possess guest kernel privileges or the ability to load and run kernel software within the guest. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (High) reflects a local attack vector with low privilege requirements and high impact across all three security properties - consistent with a guest-kernel privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Imagination Technologies GPU driver vulnerability advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for patched DDK release versions; no specific fixed release version is independently confirmed in the available data, so administrators should verify the current fix version directly against the vendor page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit infrastructure to identify all Imagination Technologies Graphics DDK installations using affected versions (25.1 RTM2-25.3 RTM, 24.2 RTM2, 23.2 RTM2, 1.18 RTM2) and their operational context. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-823 – Use of Out-of-range Pointer Offset
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today