CVE-2026-45198

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El software del kernel de un sistema operativo no seguro en una plataforma con soporte para Entorno de Ejecución Confiable, puede hacer que el firmware de la GPU arranque utilizando datos de memoria no segura. El hilo de control de la GPU (firmware) utiliza un puntero de memoria no segura perteneciente al Entorno de Ejecución Enriquecido (REE) al guardar o recuperar datos internos entre la memoria privada estrechamente acoplada y la memoria principal. Un atacante con control sobre el kernel del REE puede modificar el valor del puntero, corrompiendo los datos utilizados por el firmware de la GPU.

Information

Published : 2026-08-07 03:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-45198

Mitre link : CVE-2026-45198

CVE.ORG link : CVE-2026-45198

JSON object : View

Products Affected

No product.

CWE

CWE-822

Untrusted Pointer Dereference

{"id": "CVE-2026-45198", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45198", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:55:37.830880Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.17 RTM2", "versionType": "custom"}, {"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-08-07T03:16:19.810", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-822"}]}], "descriptions": [{"lang": "en", "value": "Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.\n\n\n\nThe GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware."}, {"lang": "es", "value": "El software del kernel de un sistema operativo no seguro en una plataforma con soporte para Entorno de Ejecuci\u00f3n Confiable, puede hacer que el firmware de la GPU arranque utilizando datos de memoria no segura.\n\nEl hilo de control de la GPU (firmware) utiliza un puntero de memoria no segura perteneciente al Entorno de Ejecuci\u00f3n Enriquecido (REE) al guardar o recuperar datos internos entre la memoria privada estrechamente acoplada y la memoria principal. Un atacante con control sobre el kernel del REE puede modificar el valor del puntero, corrompiendo los datos utilizados por el firmware de la GPU."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}