CVE-2026-41157: GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D

Synopsis

An out-of-bounds write vulnerability exists in the Imagination Technologies Graphics DDK (GPU user-space driver), affecting versions up to and including 25.3 RTM. A remote attacker with no authentication can trigger the flaw by delivering a crafted WebGPU page that the victim's browser loads, causing an integer overflow in CalculateNPOTTwiddleSparsePageMap3D that writes past an allocated memory buffer. Successful exploitation corrupts process memory and can crash the browser or GPU process, and depending on memory layout may allow arbitrary code execution. A patched-image rebuild at version 26.2 RTM is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network by serving a crafted WebGPU page to a user whose browser loads the affected GPU driver.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated party who can deliver a web page to the target can attempt exploitation.

• Victim interactionRequired

  The victim must load the malicious WebGPU page in their browser, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond delivering the crafted page.

Blast Radius

• Corrupts memory in the GPU user-space driver process, which can crash the browser or GPU process and deny the user access to GPU-accelerated content.
• Depending on memory layout at the time of exploitation, adjacent memory regions may be overwritten with attacker-influenced data, enabling arbitrary code execution within the render or GPU process.
• Confidential data held in the affected process (rendered page content, GPU buffer contents) may be read or tampered with as a result of the memory corruption.
• Process instability can spread to the host GPU driver context, potentially destabilizing other applications sharing the GPU on the same host.