CVE-2026-21732
CVE-2026-21732 is a critical-severity vulnerability in Imaginationtech Ddk with a CVSS 3.x base score of 9.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.
Key facts
- Severity: Critical (CVSS 3.x base score 9.6)
- EPSS exploit prediction: 0% (21st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-13834
- Weakness: CWE-787
- Affected product: Imaginationtech Ddk
- Published:
- Last modified:
Description
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
Frequently asked questions
- What is CVE-2026-21732?
- A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
- How severe is CVE-2026-21732?
- CVE-2026-21732 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2026-21732 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-21732?
- CVE-2026-21732 primarily affects Imaginationtech Ddk. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-21732?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2026-21732 have an EU (EUVD) identifier?
- Yes. CVE-2026-21732 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13834.
- When was CVE-2026-21732 published?
- CVE-2026-21732 was published on 2026-03-20 and last updated on 2026-06-17.
References
Affected products (4)
- cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*
- cpe:2.3:a:imaginationtech:ddk:1.17:*:*:*:*:*:*:*
- cpe:2.3:a:imaginationtech:ddk:1.18:*:*:*:*:*:*:*
- cpe:2.3:a:imaginationtech:ddk:23.2:*:*:*:*:*:*:*
More vulnerabilities in Imaginationtech Ddk
- CVE-2025-13952 — Critical (CVSS 9.8): A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a…
- CVE-2025-25176 — Critical (CVSS 9.1): Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in…
- CVE-2025-58411 — High (CVSS 8.8): Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of…
- CVE-2025-0467 — High (CVSS 8.2): Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data…
- CVE-2026-22166 — High (CVSS 8.1): A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash…
- CVE-2026-22165 — High (CVSS 8.1): A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF…
All CVEs affecting Imaginationtech Ddk →
Other CWE-787 (Out-of-bounds Write) vulnerabilities
- CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
- CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src modules). This vulnerability is…
- CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
- CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
- CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
- CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…