PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-21734 Imaginationtech CVE debrief

CVE-2026-21734 is a HIGH severity vulnerability in Imaginationtech Ddk. A web page with unusual GPU shader code can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges, this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write. The vulnerability has a CVSS score of 7.7 and is considered HIGH severity. The CVE was published on 2026-06-26T16:16:30.557Z and last modified on 2026-06-29T18:44:35.690Z.

Vendor
Imaginationtech
Product
Ddk
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Organizations using Imaginationtech Ddk should prioritize patching this vulnerability to prevent potential exploits. The vulnerability can be triggered by loading a web page with unusual GPU shader code, which can lead to a write out-of-bounds write crash in the GPU shader compiler library. If the compiler process has system privileges, this could enable further exploits on the device.

Technical summary

The vulnerability is caused by a write out-of-bounds write crash in the GPU shader compiler library when loading a web page with unusual GPU shader code. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write. The vulnerability has a CVSS vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The CWE associated with this vulnerability is CWE-823.

Defensive priority

High priority should be given to patching this vulnerability, especially on systems with elevated privileges. Organizations should review their inventory of Imaginationtech Ddk and apply patches as soon as possible.

Recommended defensive actions

  • Review and apply patches from Imaginationtech for Ddk
  • Inventory Imaginationtech Ddk installations and prioritize patching
  • Monitor for unusual GPU shader code activity
  • Implement compensating controls to limit exploitation
  • Track exception and monitor system privileges

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and vector. The vendor advisory provides mitigation information. The vulnerability is considered HIGH severity and has a CVSS score of 7.7.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-21734 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-21734

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-21734 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21734

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.imaginationtech.com/gpu-driver-vulnerabilities/

    367425dc-4d06-4041-9650-c2dc6aaa27ce - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.