EUVD-2026-43037
GHSA-q4g7-pm99-9f7g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Unprivileged local user with GPU access (AV:L, PR:L) reliably triggers the flaw (AC:L, UI:N); arbitrary physical memory access yields high C/I/A within an unchanged scope (S:U).
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code.
Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.
AnalysisAI
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unprivileged user trigger a use-after-free by issuing an improper sequence of GPU system calls. By forcing a failure path in the MMU mapping logic, an attacker leaves internal driver state incompletely cleaned up, enabling unauthorized read/write access to physical memory from shader code. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the flaw carries high confidentiality, integrity, and availability impact for local attackers.
Technical ContextAI
The affected component is the Imagination Technologies Graphics DDK (Driver Development Kit), the kernel/user driver stack for PowerVR-class GPUs (CPE cpe:2.3:a:imagination_technologies:graphics_ddk). The root cause is CWE-459 (Incomplete Cleanup): when the GPU MMU mapping logic hits an error/failure path, it fails to fully unwind and free the associated memory-management state, leaving a dangling reference that becomes a use-after-free. Because GPU shaders and the userspace-driver interface operate against MMU-mapped pages, the incompletely torn-down mapping can be reused to reach physical memory that should be inaccessible to an unprivileged process - defeating the GPU's memory isolation between contexts and mapping the UAF back to raw physical memory.
RemediationAI
Update the Imagination Graphics DDK to a fixed release per Imagination Technologies' GPU driver security advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; the input enumerates affected RTM builds (1.18, 23.2, 24.2, 25.1-25.3, 26.1 RTM1) but does not include an exact patched version, so the released patched version is not independently confirmed from the provided data and should be obtained from the vendor or SoC integrator. Because GPU DDK updates are typically delivered through the device/SoC vendor's BSP or OS image rather than as a standalone package, coordinate the fix with your hardware/OEM update channel. Where a patched driver cannot be deployed immediately, the practical compensating control is to restrict who can run untrusted GPU/compute or shader workloads - avoid running untrusted third-party code, gate access to GPU compute interfaces for low-trust users, and enforce app/process isolation, accepting that this can break legitimate GPU-accelerated applications; since the attack is local-only, tightening physical and interactive access to affected devices also reduces exposure.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privile
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today