Executive brief
A vulnerability in the Imagination Technologies Graphics DDK (Driver Development Kit) allows a malicious web page to crash the GPU shader compiler. By including specifically crafted, unusual shader code on a website, an attacker can trigger an out-of-bounds write. In certain configurations where the compiler runs with high system privileges, this could lead to further device exploitation or unauthorized access.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the Imagination Technologies GPU shader compiler library. The flaw is triggered when the compiler processes "unusual" GPU shader code containing specific edge-case values (very small values). This results in a segmentation fault or memory corruption. The attack vector is via a web page (e.g., WebGPU/WebGL), and if the compiler process is running with elevated system privileges, this memory corruption could potentially be leveraged for privilege escalation or arbitrary code execution. The issue is addressed in DDK release 26.1 RTM.
Affected products
- Imagination Technologies Graphics DDK 1.18 RTM, 23.2 RTM, 24.1 RTM to 24.2 RTM, 25.1 RTM to 25.3 RTM
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory