EUVD-2026-23446
GHSA-4h67-fm2h-4qrp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
6DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.
This is caused by improper handling of GPU memory reservation protections.
AnalysisAI
Local privilege escalation in Imagination Technologies Graphics DDK allows low-privileged users to modify read-only GPU memory and files through improper system call handling. Affects DDK versions 1.17 through 25.3 RTM across multiple release branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated local access with low-level user privileges (CVSS PR:L) on a system with Imagination Technologies Graphics DDK installed and GPU hardware accessible to unprivileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is elevated for multi-user systems and containerized GPU workloads. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with standard user account access on a shared Linux workstation runs a malicious application that invokes GPU memory allocation system calls with crafted parameters. The vulnerable Graphics DDK kernel module incorrectly grants write permissions to GPU memory regions marked read-only, allowing the attacker to modify memory-mapped kernel data structures or files shared with privileged processes. … |
| Remediation | Upgrade to patched Graphics DDK versions as specified in Imagination Technologies security advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running Imagination Technologies Graphics DDK 1.17-25.3 RTM and isolate any handling sensitive data or running untrusted code. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Kernel heap memory corruption in Imagination Technologies Graphics DDK allows a non-privileged local user to crash or de
Local privilege escalation and integrity compromise in Imagination Technologies Graphics DDK (GPU driver) allows non-pri
Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of
An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secur
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound
Share
External POC / Exploit Code
Leaving vuln.today