CVE-2026-34193

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) El software del kernel instalado y en ejecución dentro de una VM Invitada/Anfitriona puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria de la GPU prevista. Un error lógico en la traducción de direcciones permitió a un Anfitrión comprometido (Kernel) realizar escrituras arbitrarias en la memoria del firmware.

01 Jun 2026, 15:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3

01 Jun 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 13:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-34193

Mitre link : CVE-2026-34193

CVE.ORG link : CVE-2026-34193

JSON object : View

Products Affected

No product.

CWE

CWE-823

Use of Out-of-range Pointer Offset

{"id": "CVE-2026-34193", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34193", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T14:29:20.375784Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.18 RTM", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM", "versionType": "custom", "lessThanOrEqual": "25.3 RTM"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2026-06-01T13:16:31.460", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-823"}]}], "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.\n\n\n\nA logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory."}, {"lang": "es", "value": "El software del kernel instalado y en ejecuci\u00f3n dentro de una VM Invitada/Anfitriona puede enviar comandos incorrectos al firmware de la GPU para desencadenar una escritura de datos fuera de la memoria de la GPU prevista.\n\nUn error l\u00f3gico en la traducci\u00f3n de direcciones permiti\u00f3 a un Anfitri\u00f3n comprometido (Kernel) realizar escrituras arbitrarias en la memoria del firmware."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}