CVE-2026-7639CWE-459

CVE-2026-7639

High · published July 11, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code.

Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-07-11T01:17Z
Affected products (2)
ProductVersionsFixed in
imaginationtech/ddk< 26.126.1
imaginationtech/ddkall versions—
References (1)
EPSS history
Timeline
  • 10 JUL 20:50Z
    GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
    cvelistv5