Vulnerability · Published Jul 24, 2026 · Assigned by imaginationtech
CVE-2026-16280GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
Critical 9.8
In plain English
A critical-severity integer overflow in Graphics DDK from Imagination Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Imagination Technologies | Graphics DDK | 1.18 RTM223.2 RTM224.2 RTM225.1 RTM2 – through 25.3 RTM26.1 RTM1 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H