CVE-2026-22167

High

Published: 01 May 2026

Published

01 May 2026

Modified

06 May 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 0.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22167 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Imaginationtech (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-16 Memory Protection good match

prevent

SI-16 enforces memory protection mechanisms that directly prevent unauthorized GPU writes to arbitrary physical memory pages, including kernel memory, mitigating the core memory corruption vulnerability.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely remediation of the specific GPU driver flaw allowing improper system calls from non-privileged users to trigger arbitrary memory writes.

CM-11 User-installed Software partial match

prevent

CM-11 restricts or prohibits user-installed software, preventing execution of the malicious programs that issue improper GPU system calls to exploit the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local low-privileged memory corruption in GPU driver enables direct kernel/driver memory writes for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the…

GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.

Deeper analysisAI

CVE-2026-22167 is a memory corruption vulnerability in GPU drivers from Imagination Technologies, stemming from improper GPU system calls. Software installed and executed as a non-privileged user can force the GPU to write to arbitrary physical memory pages, including those not allocated by the GPU driver. This includes data pages used by the kernel and other drivers, potentially altering their behavior, as well as restricted internal GPU buffers, resulting in second-order arbitrary physical memory corruption. The issue is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability by running malicious software that issues the improper system calls. Successful exploitation enables the GPU to perform unauthorized write operations, leading to corruption of kernel memory pages and drivers, which can compromise system integrity, confidentiality, and availability at a high level. No user interaction is required, and the attack is straightforward given the low attack complexity.

Imagination Technologies has published details on mitigations and related GPU driver vulnerabilities at https://www.imaginationtech.com/gpu-driver-vulnerabilities/. Security practitioners should consult this advisory for patch information and hardening guidance specific to affected driver versions.