CVE-2026-45198: CWE-822: Untrusted Pointer Dereference CWE-501: Trust Boundary Violation in Imagination Technologies Graphics DDK
CVE-2026-45198 is a high severity vulnerability in Imagination Technologies Graphics DDK where GPU firmware may use pointers from non-secure memory controlled by the Rich Execution Environment (REE). This allows an attacker with REE kernel control to modify pointer values, potentially corrupting GPU firmware data. The flaw involves untrusted pointer dereference and trust boundary violation between secure and non-secure memory regions.
AI Analysis
Technical Summary
This vulnerability occurs because the GPU firmware thread uses a pointer from non-secure memory belonging to the REE when saving or retrieving internal data between private GPU memory and main memory. An attacker who controls the REE kernel can manipulate this pointer, leading to corruption of data used by the GPU firmware. The issue arises on platforms with Trusted Execution Environment support where kernel software from a non-secure OS can influence GPU firmware behavior. The vulnerability is classified under CWE-822 (Untrusted Pointer Dereference) and CWE-501 (Trust Boundary Violation).
Potential Impact
Successful exploitation can lead to high impact including confidentiality, integrity, and availability compromise of the GPU firmware operation. An attacker controlling the REE kernel can corrupt GPU firmware data, potentially causing arbitrary code execution or denial of service within the GPU firmware context.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor Imagination Technologies advisories for updates and apply patches once available.
CVE-2026-45198: CWE-822: Untrusted Pointer Dereference CWE-501: Trust Boundary Violation in Imagination Technologies Graphics DDK
Description
CVE-2026-45198 is a high severity vulnerability in Imagination Technologies Graphics DDK where GPU firmware may use pointers from non-secure memory controlled by the Rich Execution Environment (REE). This allows an attacker with REE kernel control to modify pointer values, potentially corrupting GPU firmware data. The flaw involves untrusted pointer dereference and trust boundary violation between secure and non-secure memory regions.
CVSS v3.1
Score 7.8high
Affected software
Imagination Technologies
Graphics DDK
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability occurs because the GPU firmware thread uses a pointer from non-secure memory belonging to the REE when saving or retrieving internal data between private GPU memory and main memory. An attacker who controls the REE kernel can manipulate this pointer, leading to corruption of data used by the GPU firmware. The issue arises on platforms with Trusted Execution Environment support where kernel software from a non-secure OS can influence GPU firmware behavior. The vulnerability is classified under CWE-822 (Untrusted Pointer Dereference) and CWE-501 (Trust Boundary Violation).
Potential Impact
Successful exploitation can lead to high impact including confidentiality, integrity, and availability compromise of the GPU firmware operation. An attacker controlling the REE kernel can corrupt GPU firmware data, potentially causing arbitrary code execution or denial of service within the GPU firmware context.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor Imagination Technologies advisories for updates and apply patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- imaginationtech
- Date Reserved
- 2026-05-11T10:58:04.162Z
- State
- PUBLISHED
Threat ID: 6a754271bf8831d5399e378f
Added to database: 08/07/2026, 02:26:57 UTC
Last enriched: 08/14/2026, 16:00:34 UTC
Last updated: 09/20/2026, 22:01:34 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.