CVE-2026-74915None▾ SunlitA web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics worklo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.
graphics_ddk 1.18 RTM2graphics_ddk 23.2 RTM2graphics_ddk 24.2 RTM2graphics_ddk >= 25.1 RTM2 <= 25.3 RTMgraphics_ddk 26.1 RTM2graphics_ddk 26.2 RTMRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74912NoneGPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CVE-2026-15466NoneGPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
CVE-2026-18629NoneGPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
CVE-2026-19199NoneGPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
CVE-2026-65587NoneGPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
CVE-2026-65586NoneGPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM