CVE-2026-21732: GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21732?
CVE-2026-21732 has a critical severity rating of 9.6 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-21732?
To fix CVE-2026-21732, update the Imaginationtech DDK and libusc to the latest version that addresses this vulnerability.
What impact does CVE-2026-21732 have on my system?
CVE-2026-21732 can lead to an out-of-bounds write crash in the GPU shader compiler, potentially enabling further exploits if the compiler process has system privileges.
Which software is affected by CVE-2026-21732?
CVE-2026-21732 affects the Imaginationtech DDK and the libusc library used for GPU operations.
Can CVE-2026-21732 be exploited remotely?
Yes, CVE-2026-21732 can be exploited remotely by loading a web page with specially crafted GPU shader code.