CVE-2026-45198
Received Received - Intake

GPU Firmware Pointer Corruption via Non-Secure Kernel

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: imaginationtech

Description
Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-45198
EUVD
EUVD-2026-54346

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-822 The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a GPU firmware issue where a pointer from non-secure memory (controlled by the Rich Execution Environment kernel) is used to access internal GPU data. An attacker with kernel access can modify this pointer, leading to data corruption in the GPU firmware during operations.

Detection Guidance

This vulnerability involves GPU firmware corruption due to insecure memory pointers from the Rich Execution Environment kernel. Detection requires checking GPU firmware integrity and memory pointer validation. No specific commands are provided in the context. Review GPU firmware logs and memory access patterns for anomalies.

Impact Analysis

If exploited, this flaw could allow an attacker to corrupt GPU firmware operations, potentially causing system instability, crashes, or unexpected behavior. It may also enable further attacks if the GPU is used for sensitive tasks like graphics processing or compute workloads.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or corruption of GPU firmware data, which may impact data integrity and confidentiality. Such risks could affect compliance with standards requiring secure data handling, like GDPR's data protection principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update GPU firmware from a secure source and ensure the operating system kernel is trusted. Avoid using non-secure memory for GPU operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart