CVE-2026-18629
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the GPU compiler process allows a web page containing unusual GPU shader code to cause a memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges, this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow, which can cause incorrect memory size calculations and subsequent invalid program behaviour.
Risk Assessment
The organization may experience crashes of the GPU compiler process and, where system privileges are involved, more severe consequences including privilege escalation or further exploitation on the device. The risk is particularly relevant in environments where untrusted web pages with shader code are loaded.
Recommendation
Update the GPU compiler software to the latest version containing the fix. Restrict processing of untrusted shaders and consider running the compiler without system privileges.
Related vulnerabilities
- CVE-2026-65555Critical
The Uncanny Toolkit for LearnDash plugin (through version 3.8.2) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain access to functionality reserved for higher roles.
- CVE-2026-119481Critical
The JetFormBuilder plugin (through version 3.6.7.1) contains an incorrect privilege assignment vulnerability enabling privilege escalation. A low-privileged user can perform actions reserved for higher roles.
- CVE-2026-114425Critical
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
- CVE-2026-114424Critical
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
- CVE-2026-77690High
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
- CVE-2026-121802Critical
@better-auth/expo before 1.7.16 signs a caller-supplied state value without verifying that it was issued by the server. This allows account-takeover outcomes, such as unauthenticated changes of any account's email address.
- CVE-2026-121615Critical
Linksys E5600 1.1.0.26 contains an improper authentication vulnerability in /cgi-bin/mesh_login.cgi (Login Handler). The attack can be launched remotely and the exploit has been publicly disclosed. The vendor did not respond and the product is no longer supported.
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS