{"id":"CVE-2023-44216","aliases":["EUVD-2023-48575","GHSA-fjqr-32v8-6gf9","UBUNTU-CVE-2023-44216"],"status":"published","title":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software...","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0172,"percentile":0.77779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-203"],"published":"2023-09-26T00:00:00Z","modified":"2026-06-17T06:27:08Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nvidia-graphics-drivers-304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["304.128-0ubuntu1","304.131-0ubuntu2","304.131-0ubuntu3","304.132-0ubuntu0.16.04.2","304.134-0ubuntu0.16.04.1","304.135-0ubuntu0.16.04.1","304.135-0ubuntu0.16.04.2","304.135-0ubuntu0.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nvidia-graphics-drivers-340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["340.93-0ubuntu1","340.93-0ubuntu2","340.96-0ubuntu1","340.96-0ubuntu2","340.96-0ubuntu3","340.98-0ubuntu0.16.04.1","340.101-0ubuntu0.16.04.1","340.102-0ubuntu0.16.04.1","340.102-0ubuntu0.16.04.2","340.104-0ubuntu0.16.04.1","340.107-0ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["340.107-0ubuntu7","340.107-0ubuntu8","340.107-0ubuntu9","340.108-0ubuntu1","340.108-0ubuntu2","340.108-0ubuntu5.20.04.1","340.108-0ubuntu5.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-390","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["390.129-0ubuntu2","390.132-0ubuntu1","390.132-0ubuntu2","390.138-0ubuntu0.20.04.1","390.141-0ubuntu0.20.04.1","390.143-0ubuntu0.20.04.1","390.144-0ubuntu0.20.04.1","390.147-0ubuntu0.20.04.1","390.151-0ubuntu0.20.04.1","390.154-0ubuntu0.20.04.1","390.157-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-430","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["430.50-0ubuntu2","430.50-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-435","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["435.21-0ubuntu2","435.21-0ubuntu3","435.21-0ubuntu4","435.21-0ubuntu5","435.21-0ubuntu6","435.21-0ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-440","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["440.31-0ubuntu1","440.36-0ubuntu1","440.44-0ubuntu1","440.44-0ubuntu2","440.59-0ubuntu1","440.59-0ubuntu2","440.64-0ubuntu1","440.64-0ubuntu2","440.64-0ubuntu3","440.82-0ubuntu1","440.82+really.440.64-0ubuntu4","440.82+really.440.64-0ubuntu5","440.82+really.440.64-0ubuntu6","440.100-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-450","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["450.66-0ubuntu0.20.04.1","450.80.02-0ubuntu0.20.04.2","450.102.04-0ubuntu0.20.04.1","450.102.04-0ubuntu0.20.04.2","450.119.03-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-460","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["460.32.03-0ubuntu0.20.04.1","460.39-0ubuntu0.20.04.1","460.56-0ubuntu0.20.04.1","460.73.01-0ubuntu0.20.04.1","460.80-0ubuntu0.20.04.2","460.91.03-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-460-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["460.32.03-0ubuntu0.20.04.1","460.32.03-0ubuntu0.20.04.2","460.73.01-0ubuntu0.20.04.1","460.91.03-0ubuntu0.20.04.1","460.106.00-0ubuntu0.20.04.1","460.106.00-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-510","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["510.47.03-0ubuntu0.20.04.1","510.54-0ubuntu0.20.04.1","510.60.02-0ubuntu0.20.04.2","510.73.05-0ubuntu0.20.04.1","510.85.02-0ubuntu0.20.04.1","510.108.03-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nvidia-graphics-drivers-520","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["520.56.06-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-390","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["390.144-0ubuntu2","390.144-0ubuntu3","390.147-0ubuntu1","390.151-0ubuntu0.22.04.1","390.154-0ubuntu0.22.04.1","390.157-0ubuntu0.22.04.1","390.157-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-418-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["418.211.00-0ubuntu2","418.226.00-0ubuntu2","418.226.00-0ubuntu3","418.226.00-0ubuntu4","418.226.00-0ubuntu5~0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-430","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["430.50-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-440","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["440.100-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-450","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["450.119.03-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-455","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["455.45.01-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-460","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["460.91.03-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-510","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["510.54-0ubuntu1","510.54-0ubuntu2","510.60.02-0ubuntu1","510.73.05-0ubuntu0.22.04.1","510.85.02-0ubuntu0.22.04.1","510.85.02-0ubuntu0.22.04.2","510.108.03-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nvidia-graphics-drivers-520","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["520.56.06-0ubuntu0.22.04.1"]}],"products":[{"vendor":"amd","product":"ryzen_5_7600x"},{"vendor":"amd","product":"ryzen_7_4800u"},{"vendor":"apple","product":"m1_mac_mini"},{"vendor":"apple","product":"macos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"google","product":"android"},{"vendor":"google","product":"pixel_6"},{"vendor":"imaginationtech","product":"powervr-gpu"},{"vendor":"intel","product":"core_i7-10510u"},{"vendor":"intel","product":"core_i7-10610u"},{"vendor":"intel","product":"core_i7-11800h"},{"vendor":"intel","product":"core_i7-12700k"},{"vendor":"intel","product":"core_i7-8700"},{"vendor":"microsoft","product":"windows_10"},{"vendor":"microsoft","product":"windows_11"},{"vendor":"nvidia","product":"geforce_rtx_2080_super"},{"vendor":"nvidia","product":"geforce_rtx_3060"}],"references":[{"url":"https://www.hertzbleed.com/gpu.zip/","tags":["x_transferred","Technical Description","report"]},{"url":"https://www.hertzbleed.com/gpu.zip/GPU-zip.pdf","tags":["x_transferred","Exploit","report"]},{"url":"https://github.com/UT-Security/gpu-zip","tags":["x_transferred","Third Party Advisory","report"]},{"url":"https://www.w3.org/TR/filter-effects-1/","tags":["x_transferred","Exploit","report"]},{"url":"https://blog.imaginationtech.com/reducing-bandwidth-pvric/","tags":["x_transferred","Press/Media Coverage","report"]},{"url":"https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level/","tags":["x_transferred","Press/Media Coverage","report"]},{"url":"https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/","tags":["x_transferred","Press/Media Coverage","Third Party Advisory","report"]},{"url":"https://news.ycombinator.com/item?id=37663159","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://www.bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack/","tags":["x_transferred","Press/Media Coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44216"},{"url":"https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack"},{"url":"https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level"},{"url":"https://blog.imaginationtech.com/reducing-bandwidth-pvric"},{"url":"https://www.bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack"},{"url":"https://www.hertzbleed.com/gpu.zip"},{"url":"https://www.w3.org/TR/filter-effects-1"},{"url":"https://github.com/advisories/GHSA-fjqr-32v8-6gf9"},{"url":"https://ubuntu.com/security/CVE-2023-44216","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44216","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-44216","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","status":"published","published":"2023-09-26T00:00:00Z","modified":"2024-09-24T18:11:55.076Z","updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-48575","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","status":"published","published":"2023-09-26T00:00:00Z","modified":"2024-09-24T18:11:55Z","updated_at":"2026-11-03T00:28:14.929509Z"}],"ghsa":[{"id":"GHSA-fjqr-32v8-6gf9","title":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software...","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","status":"published","published":"2023-09-27T15:30:39Z","modified":"2024-04-04T07:55:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:56:55.990291Z"}],"nvd":[{"id":"CVE-2023-44216","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","status":"published","published":"2023-09-27T15:19:39.583Z","modified":"2026-06-17T06:27:08.93Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"UBUNTU-CVE-2023-44216","description":"PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.","status":"published","published":"2023-09-27T15:19:00Z","modified":"2026-04-22T14:11:47.693715Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"}]}}