CVE-2026-15465

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The...

CVE-2026-49747

A vulnerability exists in the GPU DDK where software running as a non-privileged user can perform GPU system calls to trigger an integer overflow . This occurs when mapping a GPU buffer larger than 4GB , specifically involving the PVRDmaBufOpsMapCommon function. The resulting overflow causes corr...

CVE-2026-49747 GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon

Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers. The integer overflow caused when mapping a GPU buffer 4GB causes corruption of array length, and can lead to kernel panics or out of bounds access...

CVE-2026-15465 GPU DDK - Write UAF in OSDebugSignalPID due to incorrect management of PID resources

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The...

CVE-2026-15465

Software running as a non-privileged user can perform improper GPU system calls through the DDK kernel module interface . An unsupported use of this interface leads to a use-after-free condition within the OSDebugSignalPID component due to incorrect management of PID resources. This vulnerability...

EUVD-2026-124824

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The...

PT-2026-146344

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The...

CVE-2026-65587

A flaw was found in Graphics DDK. A remote attacker could exploit this vulnerability by enticing a user to visit a web page containing specially crafted WebGPU content. Processing this content triggers an out-of-bounds write in the user-space graphics driver, leading to memory corruption and a...

CVE-2026-74915

Imagination Technologies Graphics DDK is affected by an out-of-bounds (OOB) read and/or write vulnerability in the GPU GLES user-space shared library . This issue is triggered when a web page loads unusual WebGPU content into the GPU GLES render process, specifically involving improper handling o...

CVE-2026-74915 GPU DDK - OOB write in UntwiddlePOTSquare64bpp

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits ...

CVE-2026-74912

The Imagination Technologies Graphics DDK (specifically versions 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.3 RTM, 25.1 RTM2, and 26.1 RTM2 ) is vulnerable to a buffer error caused by integer truncation . This issue occurs during the mapping of GPU buffer pages, restricting the mapping range to 0GB - 4G...

CVE-2026-74912 GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB

On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and...

CVE-2026-19199

The Imagination Technologies Graphics DDK is vulnerable to a numerical error in versions 1.18 RTM2 , 23.2 RTM2 , 24.2 RTM2 , 25.1 RTM2 through 25.3 RTM , and 26.1 RTM2 . The root cause is a 32-bit integer overflow occurring in the KM driver during the conversion from page size allocation to byte ...

CVE-2026-19199 GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or...

CVE-2026-18629

The Imagination Technologies Graphics DDK is vulnerable to a numerical error in versions 23.2 RTM2 , 24.2 RTM2 , 25.1 RTM2 through 25.3 RTM , and 26.1 RTM1 . The root cause is an integer overflow during the ConvertSwitchToArrayLookup function while compiling WebGPU shaders . When a web page conta...

CVE-2026-18629 GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On...

CVE-2026-65587

A buffer error vulnerability exists in Imagination Technologies Graphics DDK versions 1.18 RTM2 , 23.2 RTM2 , 24.2 RTM2 , 25.1 RTM2 through 25.3 RTM , and 26.1 RTM1 . The flaw is triggered when a web page loads unusual WebGPU content into the GPU GLES render process , causing an out-of-bounds wri...

CVE-2026-65587 GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside t...

CVE-2026-65586 GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control driver and accessed by ...

CVE-2026-65586

The Imagination Technologies Graphics DDK (versions 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, and 26.1 RTM2) contains a resource management error (specifically a Use After Free vulnerability) in its GPU DDK component. The root cause is a missing cleanup reference for an abort c...