High · 7.8 CVE-2026-45196 EUVD-2026-43039GHSA-5xwh-rf6v-6cj6

GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

Published Jul 10, 2026 · Updated Jul 15, 2026 · Assigned by imaginationtech

Vendor: Imagination Technologies Product: Graphics DDK

Description

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

Affected products

Vendor	Product	Affected	Fixed
Imagination Technologies	Graphics DDK	1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 – ≤ 25.3 RTM, 26.1 RTM1	26.1 RTM2

Advisories 1

WID-SEC-2026-3251 Android Patchday September 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/