CVE-2026-34193 GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()

Medium 4.3 Published 1 Jun 2026 Updated 1 Jun 2026

A compromised host kernel can trigger arbitrary writes to GPU firmware memory via improper pointer validation, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-34193?

CVE-2026-34193 is a medium-severity memory corruption vulnerability in Imagination Technologies Graphics DDK, published on 1 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.

A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

Weakness: CWE-823

Which versions are affected by CVE-2026-34193?

It affects 1 product.

Products include Imaginationtech Ddk.

How do I fix CVE-2026-34193?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-34193 being exploited?

There is no known exploitation of CVE-2026-34193 in the wild and no public exploit code.

Sources

Also known as A-496245370, ASB-A-496245370, GHSA-9j5v-4c6x-8694.