{"api_version":"1","generated_at":"2026-08-07T04:18:21+00:00","cve":"CVE-2026-45198","urls":{"html":"https://cve.report/CVE-2026-45198","api":"https://cve.report/api/cve/CVE-2026-45198.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-45198","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-45198"},"summary":{"title":"GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted","description":"Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.\n\n\n\nThe GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.","state":"PUBLISHED","assigner":"imaginationtech","published_at":"2026-08-07 03:16:19","updated_at":"2026-08-07 03:16:19"},"problem_types":["CWE-822","CWE-822 CWE-822: Untrusted Pointer Dereference CWE-501: Trust Boundary Violation"],"metrics":[],"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","refsource":"367425dc-4d06-4041-9650-c2dc6aaa27ce","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45198","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45198","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 1.17 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 1.18 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 23.2 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 24.2 RTM2 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 25.1 RTM2 25.3 RTM custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"affected 26.1 RTM1 custom","platforms":["Linux","Android"]},{"source":"CNA","vendor":"Imagination Technologies","product":"Graphics DDK","version":"unaffected 26.1 RTM2 custom","platforms":["Linux","Android"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","platforms":["Linux","Android"],"product":"Graphics DDK","vendor":"Imagination Technologies","versions":[{"status":"affected","version":"1.17 RTM2","versionType":"custom"},{"status":"affected","version":"1.18 RTM2","versionType":"custom"},{"status":"affected","version":"23.2 RTM2","versionType":"custom"},{"status":"affected","version":"24.2 RTM2","versionType":"custom"},{"lessThanOrEqual":"25.3 RTM","status":"affected","version":"25.1 RTM2","versionType":"custom"},{"status":"affected","version":"26.1 RTM1","versionType":"custom"},{"status":"unaffected","version":"26.1 RTM2","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.</p><p>The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.</p>"}],"value":"Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.\n\n\n\nThe GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware."}],"impacts":[{"capecId":"CAPEC-129","descriptions":[{"lang":"en","value":"CAPEC - CAPEC-129: Pointer Manipulation (Version 3.1)"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-822","description":"CWE-822: Untrusted Pointer Dereference CWE-501: Trust Boundary Violation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-07T01:42:54.673Z","orgId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","shortName":"imaginationtech"},"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}],"source":{"discovery":"UNKNOWN"},"title":"GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"367425dc-4d06-4041-9650-c2dc6aaa27ce","assignerShortName":"imaginationtech","cveId":"CVE-2026-45198","datePublished":"2026-08-07T01:42:54.673Z","dateReserved":"2026-05-11T10:58:04.162Z","dateUpdated":"2026-08-07T01:42:54.673Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-07 03:16:19","lastModifiedDate":"2026-08-07 03:16:19","problem_types":["CWE-822","CWE-822 CWE-822: Untrusted Pointer Dereference CWE-501: Trust Boundary Violation"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"45198","Ordinal":"1","Title":"GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted","CVE":"CVE-2026-45198","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"45198","Ordinal":"1","NoteData":"Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.\n\n\n\nThe GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.","Type":"Description","Title":"GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted"}]}}}