CVE-2025-0835
GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
CVE-2025-0835 is a high vulnerability (CVSS 7.8) in Imagination Technologies Graphics Ddk, published March 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in :unknown: SoCVersion:2025-06-05.
- Severity
- 7.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.17%EPSS, 6th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
SoCVersion:2025-06-05:unknown:
Description
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:unknown:Android | SoCVersion:0 up to SoCVersion:2025-06-05, plus listed versions SoCVersion | SoCVersion:2025-06-05 |
What each source reports
CVE List Score used
GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
- Record
CVE-2025-0835- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2025-7902
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
- Record
EUVD-2025-7902- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jmqg-7x7f-3xhr
Software installed and run as a non-privileged user may conduct improper GPU system calls to...
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
- Record
GHSA-jmqg-7x7f-3xhr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
- Record
CVE-2025-0835- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.