Imagination Graphics DDK up to 26.1 RTM2 use after free

Summaryinfo

A vulnerability identified as very critical has been detected in Imagination Graphics DDK up to 1.18 RTM2/23.2 RTM2/24.2 RTM2/25.3 RTM/26.1 RTM2. Impacted is an unknown function. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-65586. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Imagination Graphics DDK up to 1.18 RTM2/23.2 RTM2/24.2 RTM2/25.3 RTM/26.1 RTM2. It has been classified as very critical. This affects some unknown functionality. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

The advisory is shared at imaginationtech.com. This vulnerability is uniquely identified as CVE-2026-65586 since 07/22/2026. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/30/2026).

Upgrading to version 26.2 RTM eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Imagination

Name

• Graphics DDK

Version

• 1.18 RTM2
• 23.2 RTM2
• 24.2 RTM2
• 25.3 RTM
• 26.1 RTM2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion