Back to overview

CVE-2026-41157

CRITICAL
9.8
CVSS 3.1
Description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.

Metadata

CVE ID
CVE-2026-41157
State
PUBLISHED
Assigner
imaginationtech
Reserved
2026-04-17 16:26 UTC
Published
2026-06-12 21:53 UTC
Last updated
2026-06-16 03:56 UTC
Primary CWE
CWE-787
CWE-787: Out-of-bounds Write
Vendor / Product
Imagination Technologies / Graphics DDK
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Imagination Technologies Graphics DDK Linux,Android 1.18 RTM, 23.2 RTM, 24.2 RTM, 25.1 RTM ≤ 25.3 RTM …
Weakness (CWE)
CWESourceDescription
CWE-787 cna CWE-787: Out-of-bounds Write
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview