CVE-2026-21733 Privilege escalation in Graphics DDK
A local attacker can exploit improper GPU memory protection checks to overwrite read-only shared memory, potentially escalating privileges or modifying system files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21733?
CVE-2026-21733 is a high-severity vulnerability in Imagination Technologies Graphics DDK, published on 17 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.
This is caused by improper handling of GPU memory reservation protections.
Which versions are affected by CVE-2026-21733?
It affects 1 product.
Products include Imaginationtech Ddk.
How do I fix CVE-2026-21733?
Apply the vendor's patch.
Is CVE-2026-21733 being exploited?
There is no known exploitation of CVE-2026-21733 in the wild and no public exploit code.
Other vulnerabilities in Imagination Technologies Graphics DDK
- CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
- CVE-2025-13952 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
- CVE-2026-21732 GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
- CVE-2025-25176 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
- CVE-2025-58411 GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
Sources
Also known as A-483582720, ASB-A-483582720, GHSA-4h67-fm2h-4qrp.