Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 58

Export CSV
CVE-2026-21732

GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-22163

GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU

Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared resource in a concurrent manner but does not attempt to synchronise access to the resource.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2026-21736

GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory. This is caused by improper handling of the memory protections for the user-mode wrapped memory resource.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-25177

GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2025-8109

GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation

Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2025-6573

GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite

Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2024-43701

GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices

Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2025-10865

GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-58409

GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-58411

GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario. Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-25176

GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world

Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-13952

GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. The shader code contained in the web page executes a path in the compiler that held onto an out of date pointer, pointing to a freed memory object.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-58410

GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-58407

GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-58408

GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-46709

GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak

Possible memory leak or kernel exceptions caused by reading kernel heap data after free or NULL pointer dereference kernel exception.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-46711

GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger NULL pointer dereference kernel exceptions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk
CVE-2025-0467

GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Ddk Graphics Ddk