CVE-2026-45203

{
  "id": "CVE-2026-45203",
  "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
  "published": "2026-07-10T21:16:54.760",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.\n\n\n\nA TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use."
    },
    {
      "lang": "es",
      "value": "El software del kernel instalado y ejecutándose dentro de una VM anfitriona puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura en memoria fuera del rango de memoria permitido para el kernel anfitrión.\n\nExistía un error TOCTOU donde un controlador malicioso podría modificar valores en memoria después de la validación del firmware pero antes de su uso."
    }
  ],
  "affected": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "affectedData": [
        {
          "vendor": "Imagination Technologies",
          "product": "Graphics DDK",
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "Android"
          ],
          "versions": [
            {
              "version": "1.18 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "24.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.1 RTM2",
              "lessThanOrEqual": "25.3 RTM",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM2",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T18:33:59.825342Z",
          "id": "CVE-2026-45203",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.1",
              "matchCriteriaId": "97C60721-9E04-406B-8036-D7799D679CD8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*",
              "matchCriteriaId": "B6047F4B-B29A-44F7-8F80-8A53C1917F38"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/",
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}