CVE-2026-21734

Analyzed Analyzed - Analysis Complete

GPU Shader Compiler Out-of-Bounds Write Vulnerability

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: imaginationtech

Description

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-06-29

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-15

NVD

CVE-2026-21734

EUVD

EUVD-2026-39785

Affected Vendors & Products

Vendor	Product	Version / Range
imaginationtech	ddk	to 25.2 (inc)
imaginationtech	ddk	25.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-823	The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a web page containing unusual GPU shader code is loaded into the GPU compiler process. The GPU shader compiler library can then experience an out-of-bounds write crash due to this unusual code, specifically triggered by an edge case involving a very small value in the shader code.

On certain platforms, if the GPU compiler process runs with system privileges, this out-of-bounds write can lead to a segmentation fault and potentially enable further exploits on the device.

Impact Analysis

The impact of this vulnerability includes the possibility of a crash in the GPU shader compiler process, which can cause instability or denial of service.

More critically, on platforms where the compiler process has system-level privileges, this vulnerability could be exploited to execute further attacks on the device, potentially compromising system security.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-21734. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70