---
id: CVE-2026-74915
title: GPU DDK - OOB write in UntwiddlePOTSquare64bpp
summary: >-
  A web page that contains unusual WebGPU content loaded into the GPU GLES
  render process can trigger a OOB read and/or write crash in the GPU GLES
  user-space shared library. On certain platforms, when the process executing
  graphics worklo…
severity: none
cwe:
  - CWE-823
vendor: Imagination Technologies
product: Graphics DDK
affected:
  - graphics_ddk 1.18 RTM2
  - graphics_ddk 23.2 RTM2
  - graphics_ddk 24.2 RTM2
  - graphics_ddk >= 25.1 RTM2 <= 25.3 RTM
  - graphics_ddk 26.1 RTM2
  - graphics_ddk 26.2 RTM
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T02:11:22.333Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74915'
references:
  - url: 'https://www.imaginationtech.com/gpu-driver-vulnerabilities/'
tags:
  - cve.org
epss: 0.0014
epssPercentile: 0.03307
ingestedAt: '2026-11-03T09:40:52.174Z'
---

## Overview

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.

## Affected

- `graphics_ddk 1.18 RTM2`
- `graphics_ddk 23.2 RTM2`
- `graphics_ddk 24.2 RTM2`
- `graphics_ddk >= 25.1 RTM2 <= 25.3 RTM`
- `graphics_ddk 26.1 RTM2`
- `graphics_ddk 26.2 RTM`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.