CVE-2026-45195

HighCVSS 7.8/10Last modified Oct 25, 2026

Description

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.

Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-451967.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access whichCVE-2026-451972.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data oCVE-2026-451987.8Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot CVE-2026-451997.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-452007.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when fCVE-2026-452017.8Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating phyCVE-2026-452025.5Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruCVE-2026-452037.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the CVE-2026-452045.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereCVE-2026-452055.3Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw aCVE-2026-452067.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-452077.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
CVE-2026-45195: High severity, CVSS 7.8 | Vulnix