CVE-2026-41157: Imagination Graphics DDK - Out-of-Bounds Write in CalculateNPOTTwiddleSparsePageMap3D
CVE-2026-41157 is an out-of-bounds write in the GPU user-space driver of the Imagination Technologies Graphics DDK, reached through an integer overflow in a memory size calculation. The CNA and CISA-ADP both list a CVSS base score of 9.8, and the record shows no KEV listing and no confirmed exploitation in the sources consulted. The record lists no fixed version, so remediation status should be verified against the vendor advisory.
Overview
CVE-2026-41157 affects the Imagination Technologies Graphics DDK. According to the record, an integer overflow in a memory size calculation can produce a buffer smaller than required, so later write operations can go past the intended boundary. The CNA classifies the weakness as CWE-787 (Out-of-bounds Write).
Impact
The record describes memory corruption and a possible crash of the browser or GPU process when unusual WebGPU content is loaded into the GPU render process. The sources consulted do not describe code execution or data disclosure, so those outcomes are unknown. The CVSS base score of 9.8 corresponds to a vector with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Imagination Technologies Graphics DDK, version 1.18
- Imagination Technologies Graphics DDK, version 23.2
- Imagination Technologies Graphics DDK, version 24.2
- Imagination Technologies Graphics DDK, from 25.1 up to and including 25.3
- Imagination Technologies Graphics DDK, version 26.1
The vendor reference is the Imagination GPU driver vulnerabilities page.
Exploitation status
The record shows this CVE is not listed in CISA KEV, so no active exploitation is reported by that source. No confirmed exploitation appears in the sources consulted. The SSVC record lists exploitation as none and automatable as yes. The EPSS probability recorded is 0.00522.
Remediation and mitigation
- The record lists no fixed version. Check the vendor advisory for patch information for your branch.
- Apply vendor-provided driver or software updates as soon as they are available for your environment.
- Keep browsers and GPU-related components current, and limit exposure to untrusted web content on systems running affected driver versions.
Detection guidance
- Watch for unexpected crashes or restarts of GPU or browser render processes, particularly after visiting sites that use WebGPU.
- Maintain an inventory of systems running the affected driver branches so that patching and monitoring can be prioritized.
Limitations of the available information
The record does not include fixed versions, patch details, a detailed root-cause analysis, or exploitation telemetry beyond the KEV status. The vendor advisory is referenced but its full content was not reviewed beyond what is contained in the record. Exploitability conclusions are limited to the CVSS, SSVC and EPSS data provided.
Frequently asked questions
Is CVE-2026-41157 being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The CNA lists version 1.18, version 23.2, version 24.2, version 26.1, and the range from 25.1 up to and including 25.3.
Is a fixed version available?
The record lists no fixed version, so check the vendor advisory for patch information.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.