CVE-2026-49744
Received Received - Intake

GPU Memory Write in Guest VM Kernel

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: imaginationtech

Description
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-49744
EUVD
EUVD-2026-48533

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves malicious software running inside a virtual machine (VM) sending incorrect commands to the GPU firmware. These commands can cause the GPU to write data outside the intended memory area of the VM, potentially leading to unauthorized access or control.

Impact Analysis

If exploited, this flaw could allow an attacker to escape the virtual machine environment and gain higher privileges on the host system. This might lead to unauthorized access to sensitive data or control over the affected system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart