CVE-2026-34193

MediumCVSS 4.3/10Last modified Aug 12, 2026

Description

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.

A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-823

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Aug 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-341947.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintain CVE-2026-341958.8Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the CVE-2026-341967.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtu CVE-2026-341978.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveM CVE-2026-341985.3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxie CVE-2026-342007.5Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to CVE-2026-342027.5ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's tran CVE-2026-342034.3Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via th CVE-2026-342047.1MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows CVE-2026-342059.6Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) con CVE-2026-342066.1Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from tha CVE-2026-342077.6TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL str