EUVD-2026-63809
GHSA-gm95-6x4p-6vph
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack via GPU device node; low-privilege user sufficient; no interaction or special conditions; kernel OOB yields full C/I/A impact.
Primary rating from Vendor (367425dc-4d06-4041-9650-c2dc6aaa27ce).
CVSS VectorVendor: 367425dc-4d06-4041-9650-c2dc6aaa27ce
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value.
Such crafted log2 page size could lead to 4K pages being treated as higher order pages and allowing read and/or write access to the memory beyond 4K threshold.
AnalysisAI
Out-of-bounds kernel memory read and write in Imagination Technologies Graphics DDK exposes systems with PowerVR/Rogue GPUs to full local privilege escalation from any non-privileged user process. Affected versions include Graphics DDK 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, and 26.1 RTM1 - spanning multiple release trains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on a device whose GPU is powered by an Imagination Technologies GPU IP core running Graphics DDK 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, or 26.1 RTM1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the threat profile: local, low-complexity exploitation by any non-privileged user yielding high-impact kernel memory access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Imagination Technologies GPU driver vulnerability advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for patched DDK releases; the input data does not specify an exact fixed version number, so a patched release version cannot be independently confirmed from the available data - OEM and SoC vendors should obtain updated DDK drops directly from Imagination. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running affected Imagination Technologies Graphics DDK versions (24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1) and classify by trust boundary and user access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today