CVE-2026-49746
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
Risk Assessment
The risk includes potential information leakage from kernel memory and the possibility of privilege escalation or system instability through UAF exploitation. An attacker may gain access to sensitive data or disrupt GPU operation.
Recommendation
It is recommended to update GPU drivers and firmware to versions that fix index validation and prevent out-of-bounds reads and UAF. Also, restrict access to GPU system calls for non-privileged users.
Other vulnerabilities in GPU
See all- CVE-2023-4211MediumActively exploited
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
- CVE-2026-58765Medium
In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed.
- CVE-2026-20515Medium
In the GPU module, there is a possible system crash due to use-after-free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.
Original NVD description (English source)
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS