Vulnerability-Lookup

CVE-2026-34193 (GCVE-0-2026-34193)

Vulnerability from cvelistv5 – Published: 2026-06-01 11:14 – Updated: 2026-06-01 14:29

Title

GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()

Summary

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-823 - CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)

Assigner

imaginationtech

References

1 reference

URL	Tags
https://www.imaginationtech.com/gpu-driver-vulner…

Impacted products

1 product

Vendor	Product	Version
Imagination Technologies	Graphics DDK	Affected: 1.18 RTM (custom) Affected: 23.2 RTM (custom) Affected: 24.2 RTM (custom) Affected: 25.1 RTM , ≤ 25.3 RTM (custom) Affected: 26.1 RTM1 (custom) Unaffected: 26.1 RTM2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-34193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T14:29:20.375784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T14:29:23.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "Android"
          ],
          "product": "Graphics DDK",
          "vendor": "Imagination Technologies",
          "versions": [
            {
              "status": "affected",
              "version": "1.18 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.2 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.2 RTM",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "25.3 RTM",
              "status": "affected",
              "version": "25.1 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1 RTM1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1 RTM2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\n\u003cbr\u003e\n\u003cbr\u003eA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory."
            }
          ],
          "value": "Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\n\n\n\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129: Pointer Manipulation"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-823",
              "description": "CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T11:14:50.273Z",
        "orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
        "shortName": "imaginationtech"
      },
      "references": [
        {
          "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
    "assignerShortName": "imaginationtech",
    "cveId": "CVE-2026-34193",
    "datePublished": "2026-06-01T11:14:50.273Z",
    "dateReserved": "2026-03-26T13:47:30.669Z",
    "dateUpdated": "2026-06-01T14:29:23.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34193",
      "date": "2026-07-25",
      "epss": "0.00143",
      "percentile": "0.04022"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34193\",\"sourceIdentifier\":\"367425dc-4d06-4041-9650-c2dc6aaa27ce\",\"published\":\"2026-06-01T13:16:31.460\",\"lastModified\":\"2026-07-22T07:10:00.107\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\\n\\n\\n\\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.\"},{\"lang\":\"es\",\"value\":\"El software del kernel instalado y en ejecuci\u00f3n dentro de una VM Invitada/Anfitriona puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria de la GPU prevista.\\n\\nUn error l\u00f3gico en la traducci\u00f3n de direcciones permiti\u00f3 a un Anfitri\u00f3n comprometido (Kernel) realizar escrituras arbitrarias en la memoria del firmware.\"}],\"affected\":[{\"source\":\"367425dc-4d06-4041-9650-c2dc6aaa27ce\",\"affectedData\":[{\"vendor\":\"Imagination Technologies\",\"product\":\"Graphics DDK\",\"defaultStatus\":\"unknown\",\"platforms\":[\"Linux\",\"Android\"],\"versions\":[{\"version\":\"1.18 RTM\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"23.2 RTM\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"24.2 RTM\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"25.1 RTM\",\"lessThanOrEqual\":\"25.3 RTM\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"26.1 RTM1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"26.1 RTM2\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-01T14:29:20.375784Z\",\"id\":\"CVE-2026-34193\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"367425dc-4d06-4041-9650-c2dc6aaa27ce\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-823\"}]}],\"references\":[{\"url\":\"https://www.imaginationtech.com/gpu-driver-vulnerabilities/\",\"source\":\"367425dc-4d06-4041-9650-c2dc6aaa27ce\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:50:00+00:00",
      "cve": "CVE-2026-34193",
      "id": "CVE-2026-34193",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34193.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34193\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T14:29:20.375784Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T14:28:29.805Z\"}}], \"cna\": {\"title\": \"GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-129\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-129: Pointer Manipulation\"}]}], \"affected\": [{\"vendor\": \"Imagination Technologies\", \"product\": \"Graphics DDK\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.18 RTM\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23.2 RTM\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.2 RTM\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.1 RTM\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"25.3 RTM\"}, {\"status\": \"affected\", \"version\": \"26.1 RTM1\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"26.1 RTM2\", \"versionType\": \"custom\"}], \"platforms\": [\"Linux\", \"Android\"], \"defaultStatus\": \"unknown\"}], \"references\": [{\"url\": \"https://www.imaginationtech.com/gpu-driver-vulnerabilities/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\\n\\n\\n\\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\\n\u003cbr\u003e\\n\u003cbr\u003eA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-823\", \"description\": \"CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)\"}]}], \"providerMetadata\": {\"orgId\": \"367425dc-4d06-4041-9650-c2dc6aaa27ce\", \"shortName\": \"imaginationtech\", \"dateUpdated\": \"2026-06-01T11:14:50.273Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34193\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T14:29:23.685Z\", \"dateReserved\": \"2026-03-26T13:47:30.669Z\", \"assignerOrgId\": \"367425dc-4d06-4041-9650-c2dc6aaa27ce\", \"datePublished\": \"2026-06-01T11:14:50.273Z\", \"assignerShortName\": \"imaginationtech\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34193

Vulnerability from fkie_nvd - Published: 2026-06-01 13:16 - Updated: 2026-07-22 07:10

Severity

4.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	367425dc-4d06-4041-9650-c2dc6aaa27ce	https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "Android"
          ],
          "product": "Graphics DDK",
          "vendor": "Imagination Technologies",
          "versions": [
            {
              "status": "affected",
              "version": "1.18 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.2 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.2 RTM",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "25.3 RTM",
              "status": "affected",
              "version": "25.1 RTM",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1 RTM1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1 RTM2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\n\n\n\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory."
    },
    {
      "lang": "es",
      "value": "El software del kernel instalado y en ejecuci\u00f3n dentro de una VM Invitada/Anfitriona puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria de la GPU prevista.\n\nUn error l\u00f3gico en la traducci\u00f3n de direcciones permiti\u00f3 a un Anfitri\u00f3n comprometido (Kernel) realizar escrituras arbitrarias en la memoria del firmware."
    }
  ],
  "id": "CVE-2026-34193",
  "lastModified": "2026-07-22T07:10:00.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34193",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-01T14:29:20.375784Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-01T13:16:31.460",
  "references": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"
    }
  ],
  "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-823"
        }
      ],
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "type": "Secondary"
    }
  ]
}

GHSA-9J5V-4C6X-8694

Vulnerability from github – Published: 2026-06-01 15:30 – Updated: 2026-06-01 15:30

Details

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.

A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-34193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-823"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T13:16:31Z",
    "severity": "MODERATE"
  },
  "details": "Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\n\n\n\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.",
  "id": "GHSA-9j5v-4c6x-8694",
  "modified": "2026-06-01T15:30:40Z",
  "published": "2026-06-01T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34193"
    },
    {
      "type": "WEB",
      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-34193 (GCVE-0-2026-34193)

FKIE_CVE-2026-34193

GHSA-9J5V-4C6X-8694

Tags

Sightings

Nomenclature