19
CVEs
1
Critical
16
High
0
KEV
0
PoC
14
Unpatched C/H
15.8%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
16
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16280 | Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-41154 | Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows a non-privileged local user to corrupt kernel memory through crafted GPU API calls, potentially achieving privilege escalation. The flaw stems from incorrect buffer indexing in the sparse-memory page-freeing path when pages larger than 4kB are handled. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis and EPSS is low at 0.17% (6th percentile). | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-7639 | Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unprivileged user trigger a use-after-free by issuing an improper sequence of GPU system calls. By forcing a failure path in the MMU mapping logic, an attacker leaves internal driver state incompletely cleaned up, enabling unauthorized read/write access to physical memory from shader code. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the flaw carries high confidentiality, integrity, and availability impact for local attackers. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-45198 | Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor. | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-34196 | Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user trigger a use-after-free by abusing an integer overflow in GPU memory-mapping system calls. The flaw allows two GPU virtual addresses to alias the same physical page; freeing one mapping releases the page while the second dangling mapping retains read/write access, enabling cross-process memory disclosure and corruption. No public exploit is identified at time of analysis and EPSS is low (0.15%), but the local read/write UAF primitive is a strong stepping stone to kernel-level compromise. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-45199 | Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-45196 | Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM to post malformed commands to the GPU firmware, forcing an improper GPU register access that can be leveraged to gain elevated privileges. The flaw (CWE-280, improper handling of permissions) affects multiple DDK release branches from 1.18 through 26.1 and is rated CVSS 7.8 (local, low complexity). There is no public exploit identified at time of analysis, and its EPSS probability is low (0.14%). | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-49743 | Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-49744 | Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands via its kernel-mode driver, triggering memory corruption that escapes virtualization boundaries. Affected versions include 24.2, 25.1 through 25.3, 1.18, and 23.2 RTM2 releases. No public exploit code or active exploitation has been identified; EPSS probability is very low at 0.14%. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-49745 | Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafted commands that trigger out-of-bounds memory writes beyond the guest's virtualized GPU boundaries. Affected versions include 26.1 RTM1, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, and 25.1 RTM2 through 25.3 RTM. No active exploitation or public exploit has been observed; EPSS probability is 0.14% (very low) and CISA SSVC indicates neither exploitation nor automatable attack patterns, suggesting low real-world risk despite a high CVSS score of 7.8. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-45200 | Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged user to kernel level via crafted GPU IOCTL calls. By fabricating a specific combination of flags on the GPU memory allocation interface, an attacker causes the driver to execute an incorrect double-free on the associated allocation, resulting in CWE-416-class use-after-free memory corruption in the kernel heap. CVSS 7.8 (AV:L/PR:L) accurately reflects the local-only attack surface; no public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates low observed exploitation probability. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-45203 | Local privilege escalation and memory corruption in Imagination Technologies Graphics DDK (PowerVR GPU driver kit) lets a malicious kernel driver inside a Host VM issue improper commands to the GPU firmware, causing a memory write outside the host kernel's permitted range. The flaw is a TOCTOU race in which values are altered in memory after the firmware validates them but before it uses them, bypassing the firmware's range enforcement. No public exploit identified at time of analysis, EPSS is low (0.12%, 2nd percentile), and it is not listed in CISA KEV. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-45195 | Improper privilege handling in Imagination Technologies' Graphics DDK GPU driver lets privileged kernel code inside a Host VM submit crafted commands to the GPU firmware, coercing the firmware into reading or writing host memory outside the range the host kernel is permitted to touch. Affecting Graphics DDK 1.18, 23.2, 24.2, 25.1-25.3 and 26.1 RTM, the flaw enables out-of-bounds host memory access (information disclosure and corruption) through the firmware's elevated memory privileges. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the local code-execution impact (CVSS 7.8) makes it a meaningful local privilege/boundary-bypass concern. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-21734 | Out-of-bounds write in Imagination Technologies' Graphics DDK GPU shader compiler lets a crafted web page containing unusual or edge-case shader code (e.g. WebGL/compute shaders using a very small value) corrupt memory and crash the GPU compiler process. On platforms where that compiler process runs with system privileges, the memory corruption could be chained toward privilege escalation or further device exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; impact is integrity and availability (CVSS 7.7, CWE-823). | HIGH | 7.7 | 0.1% | 39 |
No patch
|
| CVE-2026-34192 | Local privilege escalation and denial of service in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows non-privileged users to trigger a use-after-free of GPU MMU page tables via crafted GPU system calls. An error path fails to clean up before freeing the physical page-table allocation, enabling memory corruption that can be leveraged for kernel-context impact. No public exploit identified at time of analysis and SSVC reports no observed exploitation. | HIGH | 7.7 | 0.1% | 38 |
No patch
|