CVE-2026-49743 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

High 7.8 Published 24 Jul 2026 Updated 24 Jul 2026

A local attacker can exploit a use-after-free in the Imagination GPU driver to execute arbitrary code or escalate privileges on Android devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-49743?

CVE-2026-49743 is a high-severity use after free vulnerability in Imagination Technologies Graphics DDK, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.

During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

Weakness: CWE-416

Which versions are affected by CVE-2026-49743?

It affects 1 product.

Products include Imaginationtech Ddk.

How do I fix CVE-2026-49743?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-49743 being exploited?

There is no known exploitation of CVE-2026-49743 in the wild and no public exploit code.

Sources

Also known as A-505801324, ASB-A-505801324, GHSA-jh3g-mp7x-hgwq.