PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34193 Imagination Technologies CVE debrief

A logic error in GPU address translation allows a compromised Host kernel to perform arbitrary writes to firmware memory. The vulnerability exists in kernel software running inside Guest/Host VMs that can post improper commands to GPU Firmware, triggering writes outside intended GPU memory boundaries. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates an adjacent network attack vector with low attack complexity, no privileges required, no user interaction, and low integrity impact with no confidentiality or availability impact. The weakness is classified as CWE-823 (Use of Out-of-range Pointer Offset). The vendor attribution to Imagination Technologies is based on reference domain evidence with low confidence and requires review. No known exploitation in ransomware campaigns has been documented, and this CVE is not listed in CISA KEV.

Vendor
Imagination Technologies
Product
Graphics DDK
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-08-12
Advisory published
2026-06-01
Advisory updated
2026-08-12

Who should care

Organizations running virtualized environments with GPU passthrough or shared GPU access, particularly those using Imagination Technologies GPU IP. Cloud providers offering GPU-enabled VMs and enterprises with VDI (Virtual Desktop Infrastructure) deployments should prioritize assessment. Security teams monitoring for hypervisor escape or firmware compromise scenarios should include this in their threat models.

Technical summary

The vulnerability stems from a logic error in GPU address translation mechanisms. A compromised Host kernel running in a virtualized environment can craft improper commands to GPU Firmware that result in out-of-bounds writes to firmware memory rather than the intended GPU memory region. The attack requires adjacent network access (AV:A) suggesting the attacker must be on the same network segment as the target, with no authentication or user interaction needed. The integrity impact is rated Low (I:L) with no direct confidentiality or availability impact. The root cause maps to CWE-823, indicating improper pointer offset validation during address translation operations between host/kernel space and GPU firmware memory.

Defensive priority

medium

Recommended defensive actions

  • Review and apply GPU driver/firmware updates from Imagination Technologies when available
  • Restrict VM guest kernel access to GPU command interfaces where possible
  • Monitor for anomalous GPU firmware memory access patterns in virtualized environments
  • Validate GPU address translation boundaries in hypervisor configurations
  • Assess exposure of GPU passthrough configurations to untrusted guest kernels

Evidence notes

Vendor attribution derived from reference domain candidate 'Imaginationtech' with low confidence; marked for review. CVE status in NVD is 'Received'. Weakness sourced from reference 367425dc-4d06-4041-9650-c2dc6aaa27ce.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34193 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34193

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34193 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34193

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.imaginationtech.com/gpu-driver-vulnerabilities/

    367425dc-4d06-4041-9650-c2dc6aaa27ce

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.