EUVD-2026-43034
GHSA-cf99-7243-p2v7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun unprivileged app on device
-
DeliveryInvoke GPU sparse-memory API with >4kB pages
-
ExploitTrigger faulty index in page-freeing logic
-
ExecutionOOB write into kernel memory
-
PersistCorrupt kernel structures
-
ImpactEscalate to privileged/kernel control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution as a non-privileged user on a device running the affected Imagination Graphics DDK (PR:L, AV:L), and to be able to invoke the GPU driver's API. The specific technical trigger is the sparse memory allocation path using a page size larger than 4kB, which drives the faulty index in the page-freeing logic - so deployments/workloads that use larger-than-4kB GPU pages in sparse memory are the exposed condition. Limiting factors: no remote or unauthenticated access is possible (the attacker needs a foothold on the device), no user interaction of a victim is required (UI:N), and only platforms/devices shipping the vulnerable DDK versions with PowerVR GPUs are affected. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) describes a local, low-complexity attack by an already-authenticated low-privileged user yielding high confidentiality, integrity, and availability impact - a classic local kernel privilege-escalation profile, consistent with the description of a non-privileged user triggering OOB kernel reads/writes. Real-world exploitation signals are muted: EPSS is only 0.17% (6th percentile), the vulnerability is NOT in CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or imminent widespread exploitation. This is a genuine local escalation primitive worth patching on devices exposed to untrusted local apps, but the local-only attack vector and absence of exploit code place it below internet-facing critical issues in triage priority. Note the low EPSS is expected for a driver-specific local flaw and does not contradict the high CVSS. |
| Exploit ScenarioDerived | A malicious or compromised app running as an ordinary unprivileged user on a device with a PowerVR GPU issues crafted GPU API calls that exercise the sparse-memory page-freeing path with pages larger than 4kB. The incorrect buffer index drives an out-of-bounds write into kernel memory, which the attacker shapes to corrupt kernel structures and escalate to full device compromise. No public proof-of-concept is currently identified, and the local attack vector (AV:L) means the attacker must already run code on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows a non-privileged local user to corrupt kernel memory through crafted GPU API calls, potentially achieving privilege escalation. The flaw stems from incorrect buffer indexing in the sparse-memory page-freeing path when pages larger than 4kB are handled. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis and EPSS is low at 0.17% (6th percentile).
RemediationAI
Update the Imagination Graphics DDK to a fixed release beyond the affected 24.2 RTM2, 25.1 RTM2-25.3 RTM, and 26.1 RTM1 versions as directed by the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/; an exact patched version string is not enumerated in the provided data, so treat the fix as available per vendor advisory and confirm the target build with Imagination or your SoC/device integrator before deployment. Because the DDK ships inside device firmware, in practice this means applying the OS/vendor driver update that incorporates the corrected DDK. As a compensating control where patching lags, restrict the ability of untrusted or low-trust local applications to reach the GPU driver API (for example, tighten app allowlisting, sandboxing, or SELinux/seccomp policies around the GPU device nodes); the trade-off is that overly restrictive GPU access policies can break legitimate graphics or compute workloads, so validate against required apps first.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Imagination's Graphics DDK (Driver Development Kit), the kernel-mode/user-mode driver stack that services PowerVR GPUs in mobile and embedded SoCs. The vulnerability lives in the DDK's sparse memory implementation, where GPU memory can be mapped in non-contiguous pages. During page-freeing logic, when a page size larger than 4kB is used, the code computes an incorrect index into the tracking buffer, producing an out-of-bounds access. Because GPU drivers process these API calls in kernel context, the defect maps to CWE-787 (Out-of-Bounds Write) and directly touches privileged kernel memory rather than a sandboxed user buffer.
Know when Graphics Ddk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged user (AV:L/PR:L) reliably triggers OOB kernel write via GPU API (AC:L), yielding full kernel compromise so C/I/A all High.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.
When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Executive ViewAI
Imagination Technologies Graphics DDK (PowerVR GPU driver) contains a kernel memory corruption vulnerability enabling privilege escalation from any non-privileged local user, potentially leading to complete system compromise on affected platforms. This flaw affects millions of devices across mobile, IoT, and automotive deployments where PowerVR GPUs are utilized. Despite current low exploitation likelihood, the attack surface and potential impact severity require immediate organizational risk mitigation.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations include: restrict local user access to GPU APIs using OS privilege controls; disable GPU acceleration in systems where non-essential; implement system call auditing and monitoring for GPU memory API invocations; isolate affected systems from sensitive network access; prepare expedited patch deployment procedures for when vendor releases updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Exploit-DB