Graphics DDK CVE-2026-45204

Exploitation requires a local user account with permission to issue GPU system calls to the Imagination Technologies Graphics DDK kernel driver - specifically, the ability to open and interact with the GPU device node exposed by the driver. The user does not need administrative or root privileges; a standard non-privileged shell account is sufficient (CVSS PR:L). The vulnerable code path is within the kernel driver's error handling, meaning the attacker must craft a GPU ioctl or system call that triggers the error path rather than a normal execution flow. Exploitation is limited by the requirement for local code execution on a device running an affected DDK release. Limiting factors include: no network attack surface (AV:L), no user interaction from a privileged user (UI:N), and no scope change - exploitation is contained to the kernel of the vulnerable device. Impact is availability only; no credentials or data can be extracted.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects this as a local, low-complexity, availability-only vulnerability. Real-world risk signals are aligned and consistently low: EPSS is 0.15% at the 5th percentile, indicating virtually no observed exploitation activity across the global threat landscape; the vulnerability is not listed in CISA KEV; and no public exploit code has been identified. The attack is limited to users with local process execution - network-accessible attack surface does not exist. Impact is confined to denial of service (kernel crash), with no confidentiality or integrity dimension. The primary risk scenario is a malicious or compromised local user destabilizing a shared or embedded system. On multi-tenant embedded platforms or kiosk deployments using PowerVR GPU drivers, the availability impact could be operationally significant. Overall, this is a real but low-priority vulnerability with no urgency indicators beyond the scope of local access control hardening.

A local non-privileged user with shell access on an embedded or mobile device running an affected Imagination Technologies GPU driver submits a specially crafted GPU system call sequence designed to reach the vulnerable error path in the kernel thread. The null pointer dereference causes a kernel panic or exception, crashing the system or triggering a reboot - effectively denying service to all users on the device. No public exploit code has been identified at time of analysis.