The vulnerability stems from an out‑of‑bounds write in the libusc GPU shader compiler library when a web page containing unusually small shader code triggers the GPU compiler process. The resulting segmentation fault can occur during WebGPU shader compilation, and on platforms where the compiler process runs with system privileges, the flaw could be leveraged to gain higher authority on the device or to facilitate further malicious actions. The weakness is a classic out‑of‑bounds write as identified by CWE‑823.

Imagination Technologies Graphics DDK – version information not specified. The vulnerability affects devices that use the Imagination Technologies GPU driver set (Graphics DDK) on platforms where the GPU compiler process runs with system‑level privileges, such as certain embedded or desktop operating systems.

The CVSS score for this vulnerability is 7.7, indicating high severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The lack of an available public exploit means the real‑world exploitation likelihood is uncertain. However, on systems where the GPU compiler runs with elevated privileges, an attacker who can supply malicious WebGPU shader code could trigger the out‑of‑bounds write to gain higher authority on the device. The severity therefore hinges on the privilege level of the compiler process and the exposure to untrusted web content.