Medium severity · published Jun 1, 2026
CVE-2026-34193
GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
4.3
CVSS
0.1%
EPSS
No
On KEV
Description
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.
A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
Graphics DDK · Imagination Technologies
1.18 RTM; 23.2 RTM; 24.2 RTM; 25.1 RTM through 25.3 RTM; 26.1 RTM1 · source: vendor
DD
Ddk · Imaginationtech
before 26.1; 26.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34193
Vendor Advisory
https://www.imaginationtech.com/gpu-driver-vulnerabilities/
More from Graphics DDK
9.8
CVE-2026-16280
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
9.8
CVE-2026-41157
GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
9.8
CVE-2025-13952
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
9.8
CVE-2025-6573
GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite
9.6
CVE-2026-21732
GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation