CVE-2026-49745 GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0

High 7.8 Published 24 Jul 2026 Updated 24 Jul 2026

A guest VM can trigger out-of-bounds writes in the GPU firmware via improper commands, leading to privilege escalation and potential code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-49745?

CVE-2026-49745 is a high-severity memory corruption vulnerability in Imagination Technologies Graphics DDK, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.

Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

Weakness: CWE-823

Which versions are affected by CVE-2026-49745?

It affects 1 product.

Products include Imaginationtech Ddk.

How do I fix CVE-2026-49745?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-49745 being exploited?

There is no known exploitation of CVE-2026-49745 in the wild and no public exploit code.

Sources

Also known as A-518709886, ASB-A-518709886, GHSA-m4p3-4c28-422c.