{"id":"CVE-2026-49747","aliases":["EUVD-2026-124826","GHSA-7g2r-v52q-532g"],"status":"published","title":"GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer \u003e4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-11-13T02:15:30Z","modified":"2026-11-13T03:32:06Z","products":[{"vendor":"imagination technologies","product":"graphics ddk"}],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49747"},{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-7g2r-v52q-532g"}],"sources":{"cve":[{"id":"CVE-2026-49747","title":"GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer \u003e4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","status":"published","published":"2026-11-13T02:15:30.247Z","modified":"2026-11-13T02:15:30.247Z","cwes":["CWE-787"],"updated_at":"2026-11-13T03:52:40.655823Z"}],"euvd":[{"id":"EUVD-2026-124826","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer \u003e4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","status":"published","published":"2026-11-13T02:15:30Z","modified":"2026-11-13T02:15:30Z","updated_at":"2026-11-13T05:37:18.011397Z"}],"ghsa":[{"id":"GHSA-7g2r-v52q-532g","title":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an...","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer \u003e4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","status":"published","published":"2026-11-13T03:32:02Z","modified":"2026-11-13T03:32:06Z","cwes":["CWE-787"],"updated_at":"2026-11-13T03:45:11.715979Z"}],"nvd":[{"id":"CVE-2026-49747","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer \u003e4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","status":"published","published":"2026-11-13T03:17:30.323Z","modified":"2026-11-13T03:17:30.323Z","cwes":["CWE-787"],"updated_at":"2026-11-13T06:34:39.481747Z"}]}}