Vulnerability details

CVE-2026-21732

Imagination Technologies Graphics DDK

GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation

CVSS 3.1

9.6Critical

Official description

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.

CVSS scores

Score	Version	Source	Vector
9.6Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Imagination Technologies	Graphics DDK	23.2 RTM	CVEProject cvelistV5 (CNA)
Imagination Technologies	Graphics DDK	24.1 RTM ≤ v ≤ 25.1 RTM	CVEProject cvelistV5 (CNA)

References and advisories

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-21
Last updated: 2026-03-23
State: Published
Assigner (CNA): imaginationtech

Exploit prediction (EPSS)

0.3%

Probability of exploitation in 30 days

23.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-823
Use of Out-of-range Pointer Offset (4.16)