CVE-2026-41157
Deferred
Deferred - Pending Action
BaseFortify
Vulnerability report for CVE-2026-41157, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-12
Last updated on: 2026-06-17
Assigner: imaginationtech
Description
Description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Imagination | Technologies | Graphics DDK 1.18 RTM |
| Imagination | Technologies | Graphics DDK 23.2 RTM |
| Imagination | Technologies | Graphics DDK 24.2 RTM |
| Imagination | Technologies | Graphics DDK 25.1 RTM |
| Imagination | Technologies | Graphics DDK 26.1 RTM |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
