EUVD-2026-39785
GHSA-c5qr-j92g-m289
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost web page with malicious GPU shader
-
DeliveryVictim loads page on PowerVR device
-
ExploitShader passed to Graphics DDK compiler
-
ExecutionEdge-case value triggers out-of-bounds write
-
PersistCompiler process memory corrupted/crashes
-
ImpactEscalate via system-privileged compiler process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Use after free prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim's device to compile attacker-supplied GPU shader code - specifically a web page delivering unusual shader code (the description cites an edge case using a very small value) to the Graphics DDK shader compiler, e.g. via WebGL/WebGPU. The crash/OOB write itself needs no authentication (PR:N) and no special privileges, but it is gated by the victim loading the malicious content (effectively user interaction, despite the CVSS UI:N) and by the device running an affected DDK version (25.1-25.3, 24.1-24.2, 23.2, or 1.18 RTM). Escalation beyond a crash is limited to 'certain platforms' where the GPU compiler process runs with system privileges; on platforms where it is sandboxed or unprivileged, impact is largely limited to denial of service. |
| Impact | The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.7) indicates local attack vector with low complexity and no privileges, no confidentiality impact, but high integrity and availability impact - consistent with a memory-corruption crash that may be steerable into code execution. The local vector reflects that the vulnerable shader compiler runs on the device even though the malicious shader arrives via a web page. No EPSS score, KEV listing, or POC was supplied, so exploitation probability cannot be quantified from the input; the realistic signal is moderate - memory corruption in a compiler is non-trivial to weaponize into reliable RCE. One tension to verify: the CVSS sets UI:N, yet the description requires a victim to load a malicious web page, which is effectively user interaction (UI:R) - verify with the vendor. The vendor's own caveat that escalation is only meaningful 'on certain platforms when the compiler process has system privileges' means real-world severity is highly platform-dependent. |
| Exploit ScenarioDerived | An attacker hosts a web page embedding a malicious WebGL/WebGPU shader that uses the triggering edge-case value; when a victim on an affected PowerVR device visits the page, the shader is handed to the Graphics DDK compiler, which performs an out-of-bounds write and crashes (denial of service). On platforms where the compiler process holds system privileges, the attacker attempts to shape the memory corruption into code execution to escalate on the device. No public POC was provided in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Out-of-bounds write in Imagination Technologies' Graphics DDK GPU shader compiler lets a crafted web page containing unusual or edge-case shader code (e.g. WebGL/compute shaders using a very small value) corrupt memory and crash the GPU compiler process. On platforms where that compiler process runs with system privileges, the memory corruption could be chained toward privilege escalation or further device exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; impact is integrity and availability (CVSS 7.7, CWE-823).
RemediationAI
Apply the fixed Graphics DDK release from Imagination Technologies as distributed by your SoC/device vendor; consult the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ for the corrected RTM version applicable to your DDK branch (25.x, 24.x, 23.2, or 1.18), as no single exact fix version was provided in the input - Patch available per vendor advisory, released patched version not independently confirmed here. Until the updated driver is integrated, the most effective compensating control is to limit untrusted shader compilation reaching the GPU compiler: disable or restrict WebGL/WebGPU in browsers on affected devices (trade-off: breaks hardware-accelerated 3D and some web apps), and avoid loading untrusted web content on devices where the GPU compiler process runs with elevated/system privileges. Where the platform allows, reduce the privilege level of the GPU compiler process so a crash cannot escalate (trade-off: possible performance or compatibility regressions).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Imagination Technologies' Graphics DDK is the GPU driver/development kit underpinning PowerVR-class GPUs shipped in many mobile and embedded SoCs. The flaw lives in the shader compiler library, which parses and compiles GPU shader programs (the kind a browser submits via WebGL/WebGPU) inside a dedicated GPU compiler process. CWE-823 (Use of Out-of-range Pointer Offset) is the root cause class: an edge-case shader input - described as using a very small value - drives the compiler to compute a pointer/index outside the intended bounds and perform an out-of-bounds write, producing a segmentation fault and exploitable memory corruption. The affected component is identified by CPE cpe:2.3:a:imagination_technologies:graphics_ddk and tagged Buffer Overflow / Memory Corruption.
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local GPU compiler is the attack surface (AV:L) but the victim must load a malicious web page (UI:R); no auth needed (PR:N); memory corruption yields high integrity/availability impact, no data disclosure (C:N).
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
2DescriptionCVE.org
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.
Executive ViewAI
Imagination Technologies' Graphics DDK GPU shader compiler contains a critical out-of-bounds write vulnerability (CVE-2026-21734, CVSS 7.7) exploitable through malicious web content, with confirmed potential for privilege escalation on systems where the GPU compiler process operates with elevated system privileges. Organizations with Imagination GPU hardware face immediate integrity and availability risks, particularly if the compiler process runs with administrative access. No vendor patch is currently available, requiring urgent deployment of compensating controls to reduce exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WebGL in all enterprise browsers via group policy to eliminate attack vector; (2) Enforce principle of least privilege-reconfigure GPU compiler processes to run as unprivileged users rather than system or administrative accounts, eliminating privilege-escalation path; (3) Deploy mandatory process isolation and kernel-level sandboxing for all GPU-related services; (4) Implement real-time monitoring and alerting on GPU compiler process terminations and segmentation faults; (5) Restrict network and physical access to systems running affected Imagination GPU DDK on critical infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Exploit-DB