Skip to content
Imaginationtech vulnerabilities
Newest
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
CVE-2026-16280
Fix available
9.8 Critical
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
CVE-2026-49745
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
CVE-2026-49744
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed
CVE-2026-49743
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU
CVE-2026-45203
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel
CVE-2026-45196
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
CVE-2026-7639
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse
CVE-2026-41154
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem
CVE-2026-34196
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
CVE-2026-45195
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
CVE-2026-21734
Fix available
7.7 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
CVE-2026-34193
Fix available
4.3 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
CVE-2026-22166
Fix available
8.1 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
CVE-2026-22165
Fix available
8.1 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
CVE-2026-22167
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)
CVE-2026-21733
Fix available
7.3 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
CVE-2026-22163
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
CVE-2026-21732
Fix available
9.6 Critical
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
CVE-2026-21736
Fix available
4.4 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
CVE-2025-13952
Fix available
9.8 Critical
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns
CVE-2025-10865
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
CVE-2025-58411
Fix available
8.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory
CVE-2025-58409
Fix available
3.5 Low
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
CVE-2025-25176
9.1 Critical
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
CVE-2025-58408
Fix available
5.9 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
CVE-2025-58407
Fix available
7.4 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
CVE-2025-58410
Fix available
7.5 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused
CVE-2025-46711
Fix available
5.5 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak
CVE-2025-46709
7.5 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
CVE-2025-46708
Fix available
4.3 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
CVE-2025-46707
Fix available
5.2 Medium
-
imagination technologies graphics ddk, imaginationtech ddk +1 more
Possible kernel exceptions caused by reading and writing kernel heap data after free.
CVE-2025-46710
Fix available
5.7 Medium
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory
CVE-2025-25179
Fix available
7.8 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
CVE-2025-0467
Fix available
8.2 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF
CVE-2024-43703
Fix available
8.1 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
CVE-2024-43702
Fix available
8.1 High
-
imaginationtech ddk, imagination technologies graphics ddk +1 more
GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused
CVE-2024-43704
Fix available
8.4 High
-
google android, imaginationtech powervr-gpu +1 more
In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic...
CVE-2024-34747
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In multiple locations, there is a possible arbitrary code execution due to a logic error in the...
CVE-2024-34729
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper...
CVE-2024-31337
Fix available
7.8 High
-
imagination technologies graphics ddk
GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices
CVE-2024-43701
Fix available
7.8 High
-
google android, imaginationtech ddk +1 more
N/A
CVE-2024-31336
Fix available
7.8 High
-
google android, imaginationtech ddk +1 more
In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race...
CVE-2024-23716
Fix available
7.0 High
-
google android, imaginationtech powervr-gpu +1 more
In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an...
CVE-2024-31333
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic...
CVE-2024-34726
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due...
CVE-2024-34725
Fix available
7.0 High
-
google android, imaginationtech powervr-gpu +1 more
In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race...
CVE-2024-34724
Fix available
7.0 High
-
google android, imaginationtech powervr-gpu +1 more
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due...
CVE-2024-31335
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code...
CVE-2024-31334
Fix available
7.8 High
-
google android, imaginationtech powervr-gpu +1 more
In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a...
CVE-2024-23698
Fix available
7.8 High
- Show olderLoading…