{"id":"CVE-2026-19199","title":"GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet","summary":"Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersize…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"adp","cwe":["CWE-190"],"vendor":"Imagination Technologies","product":"Graphics DDK","affected":["graphics_ddk 1.18 RTM2","graphics_ddk 23.2 RTM2","graphics_ddk 24.2 RTM2","graphics_ddk >= 25.1 RTM2 <= 25.3 RTM","graphics_ddk 26.1 RTM2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:34:21.787579Z"},"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:34:49.978Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-19199","references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}],"tags":["cve.org"],"epss":0.0014,"epssPercentile":0.03359,"ingestedAt":"2026-11-03T09:40:52.172Z","slug":"CVE-2026-19199","body":"## Overview\n\nSoftware installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.\n\n## Affected\n\n- `graphics_ddk 1.18 RTM2`\n- `graphics_ddk 23.2 RTM2`\n- `graphics_ddk 24.2 RTM2`\n- `graphics_ddk >= 25.1 RTM2 <= 25.3 RTM`\n- `graphics_ddk 26.1 RTM2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":234894,"id":"CVE-2026-19199","ts":1793918474264,"field":"cvss","old":null,"new":"7.1"},{"seq":234893,"id":"CVE-2026-19199","ts":1793918474264,"field":"severity","old":"none","new":"high"}]}