How severe is CVE-2026-7639?

CVE-2026-7639 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-7639 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-7639?

CVE-2026-7639 primarily affects Imaginationtech Ddk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-7639?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-7639 published?

CVE-2026-7639 was published on 2026-07-10 and last updated on 2026-08-12.

CVE-2026-7639

CVE-2026-7639 is a high-severity vulnerability in Imaginationtech Ddk with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-459.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-459
Affected product: Imaginationtech Ddk
Published: 2026-07-10
Last modified: 2026-08-12

Description

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.

Frequently asked questions

What is CVE-2026-7639?: Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.
How severe is CVE-2026-7639?: CVE-2026-7639 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-7639 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-7639?: CVE-2026-7639 primarily affects Imaginationtech Ddk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-7639?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-7639 published?: CVE-2026-7639 was published on 2026-07-10 and last updated on 2026-08-12.

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Affected products (2)

cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*
cpe:2.3:a:imaginationtech:ddk:26.1:rtm1:*:*:*:*:*:*

More vulnerabilities in Imaginationtech Ddk

CVE-2026-16280 — Critical (CVSS 9.8): An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address…
CVE-2025-13952 — Critical (CVSS 9.8): A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a…
CVE-2026-21732 — Critical (CVSS 9.6): A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write…
CVE-2025-25176 — Critical (CVSS 9.1): Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in…
CVE-2025-58411 — High (CVSS 8.8): Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of…
CVE-2025-0467 — High (CVSS 8.2): Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data…

All CVEs affecting Imaginationtech Ddk →

Other CWE-459 vulnerabilities

CVE-2023-36468 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki…
CVE-2022-45347 — Critical (CVSS 9.8): Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session…
CVE-2021-45330 — Critical (CVSS 9.8): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies…
CVE-2021-45706 — Critical (CVSS 9.8): An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
CVE-2021-32928 — Critical (CVSS 9.8): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License…
CVE-2020-13451 — Critical (CVSS 9.8): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to…

Browse all CWE-459 vulnerabilities →