High severity · published Jun 26, 2026
CVE-2026-45195
GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
Graphics DDK · Imagination Technologies
1.18 RTM; 23.2 RTM; 24.2 RTM; 25.1 RTM through 25.3 RTM; 26.1 RTM · source: vendor
DD
Ddk · Imaginationtech
through 25.3; 26.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45195
Vendor Advisory
https://www.imaginationtech.com/gpu-driver-vulnerabilities/
More from Graphics DDK
9.8
CVE-2026-16280
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
9.8
CVE-2026-41157
GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
9.8
CVE-2025-13952
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
9.8
CVE-2025-6573
GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite
9.6
CVE-2026-21732
GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation