CVE-2026-45199: Imagination Technologies Graphics Ddk

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

Affected products

• Imagination Technologies Graphics Ddk: version 1.18 RTM2 only; version 23.2 RTM2 only; version 24.2 RTM2 only; from 25.1 RTM2, up to and including 25.3 RTM

Published 2026-08-21. Last modified 2026-09-03.