CVE-2026-49745

{
  "id": "CVE-2026-49745",
  "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
  "published": "2026-07-24T09:16:24.897",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.\n\n\n\nSoftware installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges."
    },
    {
      "lang": "es",
      "value": "El software del kernel instalado y en ejecución dentro de una máquina virtual invitada puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria GPU virtualizada de la invitada.\n\nEl software instalado y ejecutado bajo una máquina virtual invitada puede enviar comandos a la GPU que resultan en accesos a memoria fuera de límites. Estos pueden ser utilizados para escalar privilegios."
    }
  ],
  "affected": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "affectedData": [
        {
          "vendor": "Imagination Technologies",
          "product": "Graphics DDK",
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "Android"
          ],
          "versions": [
            {
              "version": "1.18 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "24.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.1 RTM2",
              "lessThanOrEqual": "25.3 RTM",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM2",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T17:21:31.407886Z",
          "id": "CVE-2026-49745",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-823"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.1",
              "matchCriteriaId": "97C60721-9E04-406B-8036-D7799D679CD8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*",
              "matchCriteriaId": "B6047F4B-B29A-44F7-8F80-8A53C1917F38"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/",
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}