Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
Check your stack
CVE-2026-18629unknown

GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation

Impact

Imagination Technologies Graphics DDK versions 23.2 RTM2, 24.2 RTM2, 25.1 RTM2, and 26.1 RTM1 are affected by an integer overflow weakness in libusc.so, potentially causing a crash or enabling further exploits. The vulnerability occurs during WebGPU shader compilation. Local access is required.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Imagination Technologies · imaginationtech

Graphics DDK

6 ranges
Platforms: Linux, Android

Compare with this publisher’s ranges. This does not inspect your installation.

affected

23.2 RTM2

custom versions

24.2 RTM2

custom versions

25.1 RTM2 → through 25.3 RTM

custom versions

26.1 RTM1

custom versions

unaffected

1.18 RTM2

custom versions

26.1 RTM2

custom versions

unknown

Other versions: unknown

Original source description

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device.

The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-18629

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-190 ↗

CWE-190: Integer Overflow or Wraparound

imaginationtech

Related →
Contributing organizations · 1
imaginationtech

Assigning organization

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources