# CVE-2026-19199: Imagination GPU DDK integer overflow in KM driver memory allocation

Source: https://junglewise.ai/threats/cve-2026-19199-software-installed-and-run-as-a-non-privileged-user-may-conduct  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-19199 · Severity: info · Published 2026-10-30

Imagination's GPU driver (DDK) contains a 32-bit integer overflow vulnerability in kernel memory (KM) driver page-to-byte conversion that can result in undersized buffer allocation. An unprivileged attacker can exploit this to map unallocated physical memory pages into a GPU context, potentially exposing sensitive kernel data.

Technologies: [Imagination Technologies GPU DDK](https://junglewise.ai/threats/technologies/gpu-ddk). Vendors: [Imagination Technologies](https://junglewise.ai/threats/vendors/imagination-technologies).

## Quick answers

**Is CVE-2026-19199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19199 being exploited in the wild.

**How severe is CVE-2026-19199?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Imagination Technologies GPU DDK 25.2 RTM and earlier.

**Is there a fix for CVE-2026-19199?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19199 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-19199?** Check whether you run Imagination Technologies GPU DDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 32-bit integer overflow occurs during page-to-byte conversion in the KM driver when calculating allocation sizes, resulting in undersized kernel buffer allocation. An attacker running with non-privileged user permissions can conduct improper system calls to trigger the overflow and gain access to unallocated or previously allocated physical pages through an attacker-controlled GPU MMU context, disclosing sensitive kernel data.

## Affected products

- Imagination Technologies GPU DDK 25.2 RTM and earlier

## Timeline

- 2026-10-30: disclosed

## References

- [https://www.imaginationtech.com/gpu-driver-vulnerabilities/](https://www.imaginationtech.com/gpu-driver-vulnerabilities/)

## Related threats

- [Imagination GPU DDK out-of-bounds array access via improper GPU system calls](https://junglewise.ai/threats/cve-2026-74911-software-installed-and-run-as-a-non-privileged-user-may-conduct)
- [Imagination GPU DDK integer overflow in buffer mapping](https://junglewise.ai/threats/cve-2026-49747-software-installed-and-run-as-a-non-privileged-user-may-conduct)
- [Imagination GPU DDK use-after-free in kernel module interface](https://junglewise.ai/threats/cve-2026-15465-software-installed-and-run-as-a-non-privileged-user-may-conduct)
- [Imagination GPU DDK out-of-bounds read/write in GLES render via WebGPU](https://junglewise.ai/threats/cve-2026-74915-a-web-page-that-contains-unusual-webgpu-content-loaded-into-the)
- [Imagination GPU DDK integer truncation in buffer mapping](https://junglewise.ai/threats/cve-2026-74912-on-gpu-systems-with-the-security-vulnerability-fix-for-applied)