EUVD-2026-54348
GHSA-xxq2-97gh-5p37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local non-privileged GPU syscall access required (AV:L, PR:L); kernel OOB read gives C:H; UAF gives A:H; no integrity impact confirmed from available data.
Primary rating from Vendor (imaginationtech).
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
4DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages.
Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
AnalysisAI
Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.
Technical ContextAI
Imagination Technologies Graphics DDK (Driver Development Kit) is the GPU driver stack distributed to OEM partners who integrate PowerVR GPU IP into their SoCs, covering mobile, embedded, and IoT devices. The vulnerability is rooted in CWE-823 (Use of Out-of-range Pointer Offset): the driver fails to properly validate array indices supplied through GPU system calls from userspace, allowing a crafted index to cause the kernel-mode driver to read memory outside the intended array bounds (OOB read). In certain code paths this also facilitates a GPU Use-After-Free (UAF) condition on arbitrary physical pages, a class of bug that can cause unpredictable kernel behavior including crashes or, in more advanced exploitation scenarios, privilege escalation primitives. The affected CPE is cpe:2.3:a:imagination_technologies:graphics_ddk:*:*:*:*:*:*:*:* across multiple release trains.
RemediationAI
The primary remediation is to obtain and deploy updated Graphics DDK releases from Imagination Technologies that correct the array index validation in the GPU syscall path. Exact fixed version numbers are not confirmed in the available data - contact Imagination Technologies or the relevant SoC/device vendor for patched DDK builds applicable to your platform, referencing the vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Because the vulnerability requires a local non-privileged user to issue GPU system calls, a compensating control where patching is not immediately available is to restrict or audit which users or processes have access to the GPU device node (e.g., /dev/pvr* or equivalent); removing unprivileged applications from the gpu or render group limits the attack surface. This trade-off disables GPU acceleration for restricted users. Sandboxing or seccomp filtering of GPU ioctl syscalls in application containers is an additional mitigating layer but requires profiling the specific ioctl surface for each DDK version.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands
Same weakness CWE-823 – Use of Out-of-range Pointer Offset
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today