{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-34196",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-34196",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-07-10T20:42:17.526Z",
    "updatedAt": "2026-07-13T18:55:28.947Z",
    "importedAt": "2026-10-24T01:58:08.712Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem",
      "summary": "Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping\n\n\n\nThe second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.",
      "affected": [
        {
          "vendor": "Imagination Technologies",
          "product": "Graphics DDK",
          "platforms": [
            "Linux",
            "Android"
          ],
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "1.18 RTM2",
              "status": "affected",
              "versionType": "custom"
            },
            {
              "version": "23.2 RTM2",
              "status": "affected",
              "versionType": "custom"
            },
            {
              "version": "24.2 RTM2",
              "status": "affected",
              "versionType": "custom"
            },
            {
              "version": "25.1 RTM2",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "25.3 RTM"
            },
            {
              "version": "26.1 RTM1",
              "status": "affected",
              "versionType": "custom"
            },
            {
              "version": "26.1 RTM2",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  }
}