Vulnerability · Published Apr 17, 2026 · Assigned by imaginationtech
CVE-2026-21733GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)
High 7.3
In plain English
A high-severity improper input validation in Graphics DDK from Imagination Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)<0.1%top 99.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protections.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Imagination Technologies | Graphics DDK | 1.18 RTM23.2 RTM24.1 RTM – through 24.2 RTM25.1 RTM – through 25.3 RTM |
Weakness: CWE-280, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L