CVE-2026-0427
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual Machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.
Risk Assessment
An attacker with admin privileges in one VM may access data or resources belonging to another VM, breaking VM isolation. This could lead to information leakage or disruption of other virtual machines.
Recommendation
Update GPU firmware to the latest version containing the fix. Consider restricting administrative privileges within VMs and monitoring for unusual cross-VM activity.
Other vulnerabilities in GPU firmware
See all- CVE-2026-45197Low
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.
- CVE-2026-45199High
Kernel software running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. This can result in out of bounds memory accesses and be used to escalate privileges.
- CVE-2026-45198High
Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.
- CVE-2026-45196High
A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, leading to unauthorized GPU register access and privilege escalation.
- CVE-2026-45195High
A vulnerability in kernel software running inside a Host VM allows sending improper commands to the GPU firmware, potentially causing memory read or write outside the permitted range. Addresses passed to the GPU firmware can be used to gain more privileged memory access than allowed by the system.
- CVE-2026-34193Medium
Kernel software in a Guest/Host VM may send improper commands to GPU firmware, causing out-of-bounds writes. A logic error in address translation allows a compromised Host (Kernel) to perform arbitrary writes to firmware memory.
- CVE-2025-58407High
Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine.
Original NVD description (English source)
Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS