IT
Vendor
Imagination Technologies
87
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-45197 | GD Graphics DDK Imagination Technologies | 2.5 | Sep 4 | GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet |
| CVE-2026-45200 | GD Graphics DDK Imagination Technologies | 7.8 | Sep 4 | GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags |
| CVE-2026-45202 | GD Graphics DDK Imagination Technologies | 5.5 | Aug 21 | GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast` |
| CVE-2026-45201 | GD Graphics DDK Imagination Technologies | 7.8 | Aug 21 | GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory |
| CVE-2026-45199 | GD Graphics DDK Imagination Technologies | 7.8 | Aug 21 | GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers |
| CVE-2026-49746 | GD Graphics DDK Imagination Technologies | 7.1 | Aug 7 | GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem |
| CVE-2026-45204 | GD Graphics DDK Imagination Technologies | 5.5 | Aug 7 | GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory |
| CVE-2026-45198 | GD Graphics DDK Imagination Technologies | 7.8 | Aug 7 | GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted |
| CVE-2026-16280 | GD Graphics DDK Imagination Technologies | 9.8 | Jul 24 | GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset |
| CVE-2026-49745 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 24 | GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 |
| CVE-2026-49744 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 24 | GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() |
| CVE-2026-49743 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 24 | GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed |
| CVE-2026-45203 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 10 | GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU |
| CVE-2026-45196 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 10 | GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel |
| CVE-2026-7639 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 10 | GPU DDK - Page UAF read in PMMETA_PROTECT heap memory |
| CVE-2026-41154 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 10 | GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse |
| CVE-2026-34196 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 10 | GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem |
| CVE-2026-45195 | GD Graphics DDK Imagination Technologies | 7.8 | Jun 26 | GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted |
| CVE-2026-21734 | GD Graphics DDK Imagination Technologies | 7.7 | Jun 26 | GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation |
| CVE-2026-41156 | GD Graphics DDK Imagination Technologies | 7.7 | Jun 19 | GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference |
| CVE-2026-34192 | GD Graphics DDK Imagination Technologies | 7.7 | Jun 19 | GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries |
| CVE-2026-41158 | GD Graphics DDK Imagination Technologies | 7.8 | Jun 12 | GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink |
| CVE-2026-41157 | GD Graphics DDK Imagination Technologies | 9.8 | Jun 12 | GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D |
| CVE-2026-41155 | GD Graphics DDK Imagination Technologies | 5.5 | Jun 12 | GPU DDK - SharedSecMem mapped into all GPU virtual address spaces |
| CVE-2026-34195 | GD Graphics DDK Imagination Technologies | 8.8 | Jun 12 | GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes |
| CVE-2026-34194 | GD Graphics DDK Imagination Technologies | 7.1 | Jun 8 | GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count |
| CVE-2026-22164 | GD Graphics DDK Imagination Technologies | 7.5 | Jun 8 | GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical |
| CVE-2026-34193 | GD Graphics DDK Imagination Technologies | 4.3 | Jun 1 | GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() |
| CVE-2026-22166 | GD Graphics DDK Imagination Technologies | 8.1 | May 1 | GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable |
| CVE-2026-22165 | GD Graphics DDK Imagination Technologies | 8.1 | May 1 | GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs |
| CVE-2026-22167 | GD Graphics DDK Imagination Technologies | 7.8 | May 1 | GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory |
| CVE-2026-21733 | GD Graphics DDK Imagination Technologies | 7.3 | Apr 17 | GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) |
| CVE-2026-22163 | GD Graphics DDK Imagination Technologies | 7.8 | Mar 20 | GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU |
| CVE-2026-21732 | GD Graphics DDK Imagination Technologies | 9.6 | Mar 20 | GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation |
| CVE-2026-21736 | GD Graphics DDK Imagination Technologies | 4.4 | Mar 9 | GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled |
| CVE-2025-13952 | GD Graphics DDK Imagination Technologies | 9.8 | Jan 24 | GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP |
| CVE-2025-10865 | GD Graphics DDK Imagination Technologies | 7.8 | Jan 13 | GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns |
| CVE-2025-58411 | GD Graphics DDK Imagination Technologies | 8.8 | Jan 13 | GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF |
| CVE-2025-58409 | GD Graphics DDK Imagination Technologies | 3.5 | Jan 13 | GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory |
| CVE-2025-25176 | GD Graphics DDK Imagination Technologies | 9.1 | Jan 13 | GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world |
| CVE-2025-58408 | GD Graphics DDK Imagination Technologies | 5.9 | Dec 1 | GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code |
| CVE-2025-58407 | GD Graphics DDK Imagination Technologies | 7.4 | Nov 17 | GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet |
| CVE-2025-58410 | GD Graphics DDK Imagination Technologies | 7.5 | Nov 17 | GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR |
| CVE-2025-46711 | GD Graphics DDK Imagination Technologies | 5.5 | Sep 22 | GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused |
| CVE-2025-25177 | GD Graphics DDK Imagination Technologies | 5.1 | Sep 22 | GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF |
| CVE-2025-46709 | GD Graphics DDK Imagination Technologies | 7.5 | Aug 8 | GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak |
| CVE-2025-6573 | GD Graphics DDK Imagination Technologies | 9.8 | Aug 8 | GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite |
| CVE-2025-8109 | GD Graphics DDK Imagination Technologies | 8.8 | Aug 4 | GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation |
| CVE-2025-25180 | GD Graphics DDK Imagination Technologies | 7.8 | Jul 14 | GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist |
| CVE-2025-46708 | GD Graphics DDK Imagination Technologies | 4.3 | Jun 27 | GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs |
| CVE-2025-46707 | GD Graphics DDK Imagination Technologies | 5.2 | Jun 27 | GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it |
| CVE-2025-46710 | GD Graphics DDK Imagination Technologies | 5.7 | Jun 16 | Possible kernel exceptions caused by reading and writing kernel heap data after free |
| CVE-2025-25179 | GD Graphics DDK Imagination Technologies | 7.8 | Jun 2 | GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory |
| CVE-2024-47893 | GD Graphics DDK Imagination Technologies | 6.5 | May 17 | GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups) |
| CVE-2025-1706 | GD Graphics DDK Imagination Technologies | 7.5 | May 17 | GPU DDK - Improper locking when accessing the pvr_exp_fence object |
| CVE-2025-0467 | GD Graphics DDK Imagination Technologies | 8.2 | Apr 18 | GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write |
| CVE-2025-25178 | GD Graphics DDK Imagination Technologies | 7.8 | Apr 4 | GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory |
| CVE-2025-0468 | GD Graphics DDK Imagination Technologies | 7.1 | Apr 4 | GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA) |
| CVE-2025-0835 | GD Graphics DDK Imagination Technologies | 7.8 | Mar 24 | GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails |
| CVE-2025-0478 | GD Graphics DDK Imagination Technologies | 7.8 | Mar 24 | GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object |