CVE-2026-49746

{
  "id": "CVE-2026-49746",
  "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
  "published": "2026-08-07T03:16:20.057",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages.\n\n\n\nIncorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages."
    },
    {
      "lang": "es",
      "value": "Software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU inadecuadas para causar acceso de lectura fuera de límites (OOB) a la memoria del kernel y en ciertos casos causar un UAF de GPU de páginas arbitrarias.\n\nLa validación incorrecta del índice de un array puede llevar a una lectura OOB y potencialmente a un UAF de GPU de páginas arbitrarias."
    }
  ],
  "affected": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "affectedData": [
        {
          "vendor": "Imagination Technologies",
          "product": "Graphics DDK",
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "Android"
          ],
          "versions": [
            {
              "version": "1.18 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "23.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "24.2 RTM2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.1 RTM2",
              "lessThanOrEqual": "25.3 RTM",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.1 RTM2",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T17:52:32.818801Z",
          "id": "CVE-2026-49746",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-823"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/",
      "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"
    }
  ]
}