CVE-2026-45197

LowCVSS 2.5/10Last modified Sep 8, 2026

Description

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory.

The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Imagination Technologies	Graphics DDK	1.18 RTM2; 23.2 RTM2; 24.2 RTM2; >= 25.1 RTM2, <= 25.3 RTM; 26.1 RTM1

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Timeline

Published: Sep 4, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-451987.8Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot CVE-2026-451997.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-452007.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when f CVE-2026-452017.8Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating phy CVE-2026-452025.5Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corru CVE-2026-452037.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the CVE-2026-452045.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dere CVE-2026-452055.3Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a CVE-2026-452067.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-452077.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-452087.8A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installa CVE-2026-452097.5Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Le