Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-45195: Host VM kernel can cause GPU memory overrun
CVE-2026-45195 · published 2 months ago
Summary
The operating system inside a virtual machine can send malformed commands to the GPU's internal software, letting it read or write memory it shouldn't. This could expose sensitive data or cause system instability. Apply any available updates to the GPU firmware and restrict direct GPU access from virtual machines.
What to do
- Update google :unknown: to version SoCVersion:2026-09-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :unknown: |
>= SoCVersion:0, < SoCVersion:2026-09-05 Fix: upgrade to SoCVersion:2026-09-05
|
|
| – | imaginationtech | ddk |
<= 25.3 26.1 cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:* |
Original advisory text
ASB-A-505492453
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
References
- https://source.android.com/security/bulletin/2026-09-01 Vendor Advisory
- https://www.imaginationtech.com/gpu-driver-vulnerabilities/ Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.8
High
Type
CWE-280Improper Handling of Insufficient Permissions or Privileges
Timeline
Published1 Sep 2026
Updated26 Oct 2026
First seen26 Jun 2026
Track software like this
Free during beta