CVE-2026-49745
Received Received - Intake

GPU Memory Write in Virtualized Environment

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: imaginationtech

Description
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-49745
EUVD
EUVD-2026-48534

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a guest virtual machine (VM) running kernel software that sends improper commands to the GPU firmware. These commands can cause the GPU to write data outside the intended memory area of the guest VM, potentially leading to unauthorized memory access or privilege escalation.

Impact Analysis

If exploited, this vulnerability could allow an attacker in a guest VM to gain elevated privileges on the host system or other VMs. This might lead to unauthorized access to sensitive data, system control, or further attacks within the environment.

Mitigation Strategies

Disable GPU passthrough for untrusted guest VMs to prevent improper GPU command execution. Update GPU firmware to the latest version to patch known vulnerabilities. Monitor GPU-related logs for out-of-bounds memory access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart