Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18629— GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation

Quick assessment

Affected
Imagination Technologies Graphics DDK
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

加载包含异常 GPU 着色器代码的网页时，该代码会被送入 GPU 编译器进程，可能导致内存分配失败。若该分配失败未得到妥善处理，编译器可能在受控的偏移量处解引用空指针，从而导致编译器进程崩溃。在某些平台上，若编译器进程拥有系统权限，此类崩溃可能进一步被利用，引发设备层面的安全漏洞。 该弱点源于对源自着色器程序的值执行算术运算时，未能有效防止整数溢出。整数溢出会导致内存大小计算错误，进而引发内存分配失败及后续的程序异常行为。溢出还可能产生非预期数值，影响内存分配及其他与安全相关的操作。

AI Predicted 7.8 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18629

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
Source: CVE Program / CVE List V5
Vulnerability Description
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Imagination Technologies Graphics DDK 1.18 RTM2 -

II. Public POCs for CVE-2026-18629

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18629

请登录查看更多情报信息。

News Coverage for CVE-2026-18629 (1)

Same Patch Batch · Imagination Technologies · 2026-10-30 · 8 CVEs total

CVE-2026-65584 GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
CVE-2026-15466 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXClo
CVE-2026-65586 GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSR
CVE-2026-65587 GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
CVE-2026-74912 GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CVE-2026-74915 GPU DDK - OOB write in UntwiddlePOTSquare64bpp
CVE-2026-19199 GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet

IV. Related Vulnerabilities

Same product: Graphics DDK
Same vendor: Imagination Technologies
Same weakness: CWE-190