Graphics DDK CVE-2026-49746

Exploitation requires a local account or process with non-privileged user access (CVSS PR:L) on a system whose SoC incorporates an Imagination Technologies PowerVR GPU running one of the affected DDK versions. The attacker must have the ability to issue GPU system calls to the DDK kernel driver - typically requiring access to the GPU device node. No network reachability is needed (AV:L). Exploitation is NOT possible remotely over a network and does NOT require elevated privileges. The primary limiting factors are: (1) physical or remote shell access to the target device, (2) the device must use a PowerVR GPU with one of the named DDK release trains, and (3) the non-privileged user must have permission to interact with the GPU device node. Default configurations on many embedded/mobile platforms do restrict GPU device access to specific user groups, which reduces but does not eliminate risk.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, score 7.1) is consistent with the description: local access with low privilege is sufficient, no user interaction is required, and the impact is confidentiality (kernel memory disclosure) and availability (UAF-induced instability). EPSS at 0.14% (4th percentile) reflects that exploitation is not currently observed at scale, and there is no CISA KEV listing. The vulnerability is not flagged as automatable or remotely exploitable, which materially reduces its urgency compared to network-exploitable kernel bugs. That said, the UAF primitive on arbitrary pages is technically significant - kernel UAF vulnerabilities in GPU drivers have historically been leveraged for local privilege escalation even when not initially classified as integrity-impacting. The I:N rating in the CVSS should be viewed with some skepticism given the UAF class; defenders should treat this as a potential LPE stepping stone rather than a pure DoS. No conflicting signal was identified between CVSS and the description.

A local non-privileged user or compromised application on a device using a PowerVR GPU with an affected DDK version constructs a malformed GPU system call containing an out-of-range array index. The DDK kernel driver processes the call without proper bounds validation, causing it to read kernel memory outside the intended buffer - leaking sensitive kernel data to userspace. In a more advanced exploitation path, the attacker triggers the UAF condition to corrupt arbitrary page metadata, potentially escalating to kernel code execution. No public exploit code has been identified at this time.