{"schemaVersion":3,"id":"CVE-2026-45200","aliases":[],"status":"published","duplicateOf":null,"title":"GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags","description":"Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption.\n\n\n\nScenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.","dates":{"published":"2026-09-04T01:45:46.041Z","modified":"2026-09-09T04:26:09.515Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00162,"percentile":0.05049,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0.051999999999999984,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.0011},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00162,"percentile":0.05049}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0011,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00162,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00162,"percentile":0.05049}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"imagination technologies","product":"graphics ddk","name":"Graphics DDK","label":"graphics ddk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"24.2 RTM2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.1 RTM2, ≤ 25.3 RTM","noFixRecorded":false,"fixedIn":null},{"text":"26.1 RTM1","noFixRecorded":false,"fixedIn":null}],"versionsText":"24.2 RTM2 | ≥ 25.1 RTM2, ≤ 25.3 RTM | 26.1 RTM1","eol":null,"hubHref":"/vendor/imagination_technologies/graphics_ddk"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","label":"www.imaginationtech.com/gpu-driver-vulnerabilities/","hostname":"www.imaginationtech.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-04T01:45:46.041Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-09T04:26:09.515Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T19:23:34.498Z","stale":false,"partial":false}}