CVE-2026-22166

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:imaginationtech:ddk::::::::
	cpe:2.3:a:imaginationtech:ddk:25.3:rtm::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una página web que contiene contenido WebGPU inusual cargado en el proceso de renderizado GLES de la GPU y puede desencadenar un fallo de escritura UAF en la biblioteca compartida de espacio de usuario GLES de la GPU. En ciertas plataformas, cuando el proceso que ejecuta la carga de trabajo de gráficos tiene privilegios de sistema, esto podría permitir un exploit posterior en el sistema.

Information

Published : 2026-05-01 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-22166

Mitre link : CVE-2026-22166

CVE.ORG link : CVE-2026-22166

JSON object : View

Products Affected

imaginationtech

ddk

CWE

CWE-416

Use After Free

{"id": "CVE-2026-22166", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22166", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-01T18:00:04.437959Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.18 RTM", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM", "versionType": "custom"}, {"status": "affected", "version": "24.1 RTM", "versionType": "custom", "lessThanOrEqual": "24.2 RTM"}, {"status": "affected", "version": "25.1 RTM", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "unaffected", "version": "26.1 RTM", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-05-01T16:16:29.563", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system."}, {"lang": "es", "value": "Una p\u00e1gina web que contiene contenido WebGPU inusual cargado en el proceso de renderizado GLES de la GPU y puede desencadenar un fallo de escritura UAF en la biblioteca compartida de espacio de usuario GLES de la GPU. En ciertas plataformas, cuando el proceso que ejecuta la carga de trabajo de gr\u00e1ficos tiene privilegios de sistema, esto podr\u00eda permitir un exploit posterior en el sistema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D75CD5B-2B2E-44C9-8422-D808630103B4", "versionEndIncluding": "25.2"}, {"criteria": "cpe:2.3:a:imaginationtech:ddk:25.3:rtm:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B3E39FF-6C96-4A0B-9CE1-595C785DF920"}], "operator": "OR"}]}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}