CVE-2026-45195
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.14%
- CWE
- CWE-280
- Published
- 2026-06-26
- Last modified
- 2026-06-26
Affected products
- Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
- Imagination Technologies Graphics DDK
Weakness type
Related vulnerabilities
- CVE-2026-69907 — Windows Enterprise App Management Elevation of Privilege Vulnerability
- CVE-2026-55468 — Wagtail: Improper restriction handling on Pages admin API
- CVE-2026-59567 — Local privilege escalation
- CVE-2026-58416 — Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- CVE-2026-73239 — Apache Allura: Missing permission checks IDOR
- CVE-2026-18860 — Velociraptor incorrect Org deletion permissions check
- CVE-2026-11804 — Program Module Vulnerability
- CVE-2026-62393 — Apache Kylin: Improper authorization in job information retrieval