CVE-2026-45199

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45199", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2026-05-11T10:58:04.162Z", "datePublished": "2026-08-21T03:36:39.887Z", "dateUpdated": "2026-08-26T18:59:52.011Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-08-21T03:36:39.887Z"}, "title": "GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-823", "description": "CWE-823: Use of Out-of-range Pointer Offset (4.16)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "platforms": ["Linux", "Android"], "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "lessThanOrEqual": "25.3 RTM", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.\n\n\n\nSoftware installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.</p><p>Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.</p>"}]}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T03:56:20.769937Z", "id": "CVE-2026-45199", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:59:52.011Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-45199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T03:56:20.769937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:59:47.211Z"}}], "cna": {"title": "GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "unaffected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.\n\n\n\nSoftware installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.", "supportingMedia": [{"type": "text/html", "value": "<p>Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.</p><p>Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-823", "description": "CWE-823: Use of Out-of-range Pointer Offset (4.16)"}]}], "providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-08-21T03:36:39.887Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45199", "state": "PUBLISHED", "dateUpdated": "2026-08-26T18:59:52.011Z", "dateReserved": "2026-05-11T10:58:04.162Z", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "datePublished": "2026-08-21T03:36:39.887Z", "assignerShortName": "imaginationtech"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["Linux", "Android"], "product": "Graphics DDK", "vendor": "Imagination Technologies", "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"lessThanOrEqual": "25.3 RTM", "status": "affected", "version": "25.1 RTM2", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}]}], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.\n\n\n\nSoftware installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges."}, {"lang": "es", "value": "El software de kernel instalado y ejecut\u00e1ndose dentro de una VM invitada puede enviar comandos indebidos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria de GPU virtualizada del invitado.\n\nEl software instalado y ejecutado bajo una VM invitada puede enviar comandos a la GPU que resultan en accesos a memoria fuera de l\u00edmites. Estos pueden usarse para escalar privilegios."}], "id": "CVE-2026-45199", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45199", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T03:56:20.769937Z", "version": "2.0.3"}}]}, "published": "2026-08-21T04:18:02.650", "references": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-823"}], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux", "android"], "status": "affected", "versions": {"scheme": "generic", "value": "1.18 RTM2"}}, {"platform": ["linux", "android"], "status": "affected", "versions": {"scheme": "generic", "value": "23.2 RTM2"}}, {"platform": ["linux", "android"], "status": "affected", "versions": {"scheme": "generic", "value": "24.2 RTM2"}}, {"platform": ["linux", "android"], "status": "affected", "versions": {"scheme": "generic", "value": "[25.1 RTM2,25.3 RTM]"}}, {"platform": ["linux", "android"], "status": "unaffected", "versions": {"scheme": "generic", "value": "26.1 RTM1"}}, {"platform": ["linux", "android"], "status": "unaffected", "versions": {"scheme": "generic", "value": "26.1 RTM2"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Graphics DDK", "source": "cna", "vendor": "Imagination Technologies"}, "product": "graphics_ddk", "vendor": "imaginationtech"}], "created": "2026-08-21T06:15:03.987443+00:00", "updated": "2026-08-26T22:30:04.063900+00:00", "vendors": ["imaginationtech", "imaginationtech$PRODUCT$graphics_ddk"]}