CVE-2026-65587
GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
Reported by imaginationtech · Published October 30, 2026
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour.
EPSS 0.14% · 3.3th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Graphics DDK | Imagination Technologies | 26.2, 25.3 RTM |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Imagination Technologies | Graphics DDK | 1.18 RTM2, 23.2 RTM2, 24.2 RTM2 |
| Imagination Technologies | Graphics DDK | 1.18, 23.2, 24.2 |
Timeline
- Oct 30, 2026 EPSS Score
- Oct 30, 2026 Coalition ESS Score
- Oct 30, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-65587
vulnetix vdb fixes CVE-2026-65587Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-65587/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart