CVE-2026-45197: Imagination Technologies Graphics Ddk

Low severity, CVSS 2.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.

Affected products

• Imagination Technologies Graphics Ddk: version 1.18 RTM2 only; version 23.2 RTM2 only; version 24.2 RTM2 only; from 25.1 RTM2, up to and including 25.3 RTM; version 26.1 RTM1 only

Published 2026-09-04. Last modified 2026-09-08.