EUVD-2026-70857
GHSA-fcpf-2c9p-9w89
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Scope changes to Changed because an unprivileged user-space process achieves kernel-level code execution, crossing the kernel security boundary; all other metrics align with the provided vector.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
5DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption.
Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.
AnalysisAI
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged user to kernel level via crafted GPU IOCTL calls. By fabricating a specific combination of flags on the GPU memory allocation interface, an attacker causes the driver to execute an incorrect double-free on the associated allocation, resulting in CWE-416-class use-after-free memory corruption in the kernel heap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have local code execution on the target system as any non-privileged (unprivileged) user account - no special privileges are required beyond the ability to open the GPU device node, which is typically accessible to all users or to members of a 'video'/'render' group on Linux systems. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability class: local execution as an unprivileged user is the only prerequisite, complexity is low because the attacker fully controls the IOCTL flag inputs, and the full C:H/I:H/A:H triad reflects the consequence of kernel heap corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to obtain and deploy an updated Graphics DDK build from Imagination Technologies or the relevant SoC/device vendor, as driver updates are distributed through the vendor's licensing chain rather than a public package repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems running Imagination Technologies Graphics DDK drivers by version number, document hardware models, and assess which systems permit local user access or remote login. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today