CVE-2026-21732
Out-of-Bounds Write in GPU Shader Compiler Causes Crash
Publication date: 2026-03-20
Last updated on: 2026-04-21
Assigner: imaginationtech
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imaginationtech | ddk | 1.17 |
| imaginationtech | ddk | 1.18 |
| imaginationtech | ddk | 23.2 |
| imaginationtech | ddk | From 24.1 (inc) to 25.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-823 | The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when a web page containing unusual GPU shader code is loaded into the GPU compiler process. Specifically, an edge case involving a very large value in switch statements within the GPU shader code can cause the GPU shader compiler to perform an out-of-bounds write. This out-of-bounds write leads to a crash (segmentation fault) in the GPU shader compiler library.
On certain platforms, if the GPU compiler process runs with system privileges, this crash could potentially be exploited further to compromise the device.
How can this vulnerability impact me? :
The primary impact of this vulnerability is that it can cause the GPU shader compiler process to crash due to an out-of-bounds write triggered by malicious or unusual shader code.
On platforms where the GPU compiler process has system-level privileges, this vulnerability could be exploited to execute further attacks on the device, potentially leading to system compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know