TI-2026-29783 Aliases CVE-2026-41157 GHSA-2m3r-7r37-rw4c

GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D

MEDIUM 49CWE-787Published 2026-06-12 · Updated 2026-06-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00358 29th percentileScored 2026-11-07

Fix Fixed Graphics DDK (Imagination Technologies): 26.2 RTM

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Imagination Technologies	Graphics DDK	1.18 RTM; 23.2 RTM; 24.2 RTM; 25.1 RTM – 25.3 RTM; 26.1 RTM	26.2 RTM	Patch available	CNA

Graphics DDK VendorImagination Technologies Affected 1.18 RTM; 23.2 RTM; 24.2 RTM; 25.1 RTM – 25.3 RTM; 26.1 RTM Fixed in 26.2 RTM Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:imaginationtech:ddk::::::::	—	—	Imagination Technologies

cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:* Versions — — ·Imagination Technologies

Remediation

Fix · CNA Graphics DDK (Imagination Technologies) Fixed in 26.2 RTM

Timeline

2026-10-02 Threatist record created from CVE-2026-41157
2026-10-03 Alias added: GHSA-2m3r-7r37-rw4c

References

Other 1

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
TI-2026-82822 Integer truncation in Imagination Graphics DDK limits buffer mapping CVSS 3.1CRITICAL 9.8
TI-2026-13612 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset CVSS 3.1CRITICAL 9.8
TI-2025-12749 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP CVSS 3.1CRITICAL 9.8
TI-2025-05971 GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite CVSS 3.1CRITICAL 9.8
TI-2025-18845 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world CVSS 3.1CRITICAL 9.1

See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences