CVE-2026-41157: GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-10-25
Weakness: CWE-787

Description

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.

Affected products

Imagination Technologies Graphics DDK: from 25.1 RTM through 25.3 RTM; 1.18 RTM, 23.2 RTM, 24.2 RTM, 26.1 RTM

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Get alerted when CVE-2026-41157 or the next vulnerability affects your stack