CVE-2026-45200

CVE-2026-45200 is a double-free flaw in a GPU driver's kernel allocation handling (listed as CWE-416): a program running as a non-privileged local user can issue improperly formed IOCTL calls to the driver. By fabricating a specific combination of flags on the allocation interface, the attacker creates an allocation scenario in which the same allocation is freed twice when released, corrupting the kernel heap. A local, low-privileged attacker could use this heap corruption to crash the machine or potentially achieve kernel memory disclosure or privilege escalation, consistent with the High ratings for confidentiality, integrity, and availability. Any system running the affected GPU driver where untrusted users can execute code is exposed, although the vendor and exact affected/fixed versions are not specified in the available data. There is no known exploitation: no public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Monitor the assigned CNA's security advisory for the affected and fixed driver versions, and update GPU drivers to the patched release as soon as it is published. Until then, restrict which users can run untrusted code on affected machines and record currently installed driver versions for comparison against the advisory. Since no active exploitation is known, routine patch-cycle handling is sufficient for now, but recheck advisories and EPSS for updates.