Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 74

Export CSV
CVE-2026-45196

GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-45203

GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-7639

GPU DDK - Page UAF read in PMMETA_PROTECT heap memory

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-21733

GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protections.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-45198

GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-45204

GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions, platform instability and denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-49746

GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-21734

GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-45195

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-34192

GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-41156

GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-41158

GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink

Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed the resource.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-34195

GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes

Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel. The product incorrectly indexes internal state when performing sparse allocation remapping.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-41155

GPU DDK - SharedSecMem mapped into all GPU virtual address spaces

An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations in the kernel module. Additionally, an attacker could disrupt the operation of another secure GPU process leading to image corruption / GPU hardware recovery. Sharing secure memory allocations among various GPU secure processes allows an attacker to corrupt shared resource affecting other users.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-41157

GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-22164

GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical

Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. By creating resources of certain types and presenting a set of parameters to the affected interface the exploit can be used to corrupt kernel memory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-34194

GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-22165

GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-22166

GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-22167

GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk