Imagination Graphics DDK up to 26.1 RTM1 GPU driver use after free

Summaryinfo

A vulnerability classified as very critical has been found in Imagination Graphics DDK up to 1.18 RTM1/23.2 RTM1/24.2 RTM2/25.3 RTM/26.1 RTM1. This affects an unknown function of the component GPU driver. This manipulation causes use after free. This vulnerability is registered as CVE-2026-49743. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability was found in Imagination Graphics DDK up to 1.18 RTM1/23.2 RTM1/24.2 RTM2/25.3 RTM/26.1 RTM1. It has been declared as very critical. Affected by this vulnerability is some unknown processing of the component GPU driver. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

The advisory is shared at imaginationtech.com. This vulnerability is known as CVE-2026-49743 since 06/01/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/24/2026).

Upgrading to version 1.18 RTM2, 23.2 RTM2 or 26.1 RTM2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-48532). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Imagination

Name

• Graphics DDK

Version

• 1.18 RTM1
• 23.2 RTM1
• 24.2 RTM2
• 25.3 RTM
• 26.1 RTM1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion