EUVD-2026-43043
GHSA-vf2q-w6vq-3hq8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel-driver access (AV:L, PR:L), TOCTOU race window raises complexity to AC:H, and out-of-bounds firmware write yields high C/I/A within an unchanged scope.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.
A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.
AnalysisAI
Local privilege escalation and memory corruption in Imagination Technologies Graphics DDK (PowerVR GPU driver kit) lets a malicious kernel driver inside a Host VM issue improper commands to the GPU firmware, causing a memory write outside the host kernel's permitted range. The flaw is a TOCTOU race in which values are altered in memory after the firmware validates them but before it uses them, bypassing the firmware's range enforcement. No public exploit identified at time of analysis, EPSS is low (0.12%, 2nd percentile), and it is not listed in CISA KEV.
Technical ContextAI
The affected component is the Imagination Graphics DDK, the driver development kit backing PowerVR-class GPUs commonly integrated into SoCs and virtualized GPU deployments. The root cause is CWE-367 (Time-of-check Time-of-use race condition): the GPU firmware validates command parameters or memory pointers supplied by the host kernel driver, but the driver modifies those values in shared/mapped memory in the window between validation and consumption. Because the firmware enforces the memory-range boundary for the host kernel, defeating that check via the race allows the firmware to perform a write outside the intended host-kernel memory region - effectively turning a validated GPU command into an out-of-bounds write primitive. The affected CPE is cpe:2.3:a:imagination_technologies:graphics_ddk.
RemediationAI
Patch available per vendor advisory - consult Imagination Technologies' GPU driver vulnerabilities page (https://www.imaginationtech.com/gpu-driver-vulnerabilities/) for the fixed DDK build corresponding to your release train, as no single exact fix version is enumerated in the available data and version numbers should not be invented. Because affected trains span 1.18 through 26.1, integrators should update to the vendor's designated fixed RTM for their branch. Where an immediate DDK update is not feasible, the practical compensating control is to restrict who can load or run kernel drivers inside the Host VM (the vuln requires attacker-controlled host kernel code), harden GPU passthrough/virtualization configurations, and limit untrusted tenants' ability to install kernel modules that talk to the GPU firmware; the trade-off is reduced flexibility for legitimate GPU driver updates and virtualization workloads. Coordinate firmware and DDK versions together, since the fix concerns the firmware's validation-to-use ordering.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today