IM
Vendor
Imaginationtech
54
CVEs
0
On KEV
0
New 30D
Products
DD9.8
Ddk
Imaginationtech
40 CVEs0 on KEV0 new
PO7.8
Powervr-gpu
Imaginationtech
13 CVEs0 on KEV0 new
GD7.8
Graphics Ddk
Imaginationtech
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-16280 | DD Ddk Imaginationtech | 9.8 | Jul 24 | GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset |
| CVE-2026-49745 | DD Ddk Imaginationtech | 7.8 | Jul 24 | GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 |
| CVE-2026-49744 | DD Ddk Imaginationtech | 7.8 | Jul 24 | GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() |
| CVE-2026-49743 | DD Ddk Imaginationtech | 7.8 | Jul 24 | GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed |
| CVE-2026-45203 | DD Ddk Imaginationtech | 7.8 | Jul 10 | GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU |
| CVE-2026-45196 | DD Ddk Imaginationtech | 7.8 | Jul 10 | GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel |
| CVE-2026-7639 | DD Ddk Imaginationtech | 7.8 | Jul 10 | GPU DDK - Page UAF read in PMMETA_PROTECT heap memory |
| CVE-2026-41154 | DD Ddk Imaginationtech | 7.8 | Jul 10 | GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse |
| CVE-2026-34196 | DD Ddk Imaginationtech | 7.8 | Jul 10 | GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem |
| CVE-2026-45195 | DD Ddk Imaginationtech | 7.8 | Jun 26 | GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted |
| CVE-2026-21734 | DD Ddk Imaginationtech | 7.7 | Jun 26 | GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation |
| CVE-2026-34193 | DD Ddk Imaginationtech | 4.3 | Jun 1 | GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() |
| CVE-2026-22166 | DD Ddk Imaginationtech | 8.1 | May 1 | GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable |
| CVE-2026-22165 | DD Ddk Imaginationtech | 8.1 | May 1 | GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs |
| CVE-2026-22167 | DD Ddk Imaginationtech | 7.8 | May 1 | GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory |
| CVE-2026-21733 | DD Ddk Imaginationtech | 7.3 | Apr 17 | GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) |
| CVE-2026-22163 | DD Ddk Imaginationtech | 7.8 | Mar 20 | GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU |
| CVE-2026-21732 | DD Ddk Imaginationtech | 9.6 | Mar 20 | GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation |
| CVE-2026-21736 | DD Ddk Imaginationtech | 4.4 | Mar 9 | GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled |
| CVE-2025-13952 | DD Ddk Imaginationtech | 9.8 | Jan 24 | GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP |
| CVE-2025-10865 | DD Ddk Imaginationtech | 7.8 | Jan 13 | GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns |
| CVE-2025-58411 | DD Ddk Imaginationtech | 8.8 | Jan 13 | GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF |
| CVE-2025-58409 | DD Ddk Imaginationtech | 3.5 | Jan 13 | GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory |
| CVE-2025-25176 | DD Ddk Imaginationtech | 9.1 | Jan 13 | GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world |
| CVE-2025-58408 | DD Ddk Imaginationtech | 5.9 | Dec 1 | GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code |
| CVE-2025-58407 | DD Ddk Imaginationtech | 7.4 | Nov 17 | GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet |
| CVE-2025-58410 | DD Ddk Imaginationtech | 7.5 | Nov 17 | GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR |
| CVE-2025-46711 | DD Ddk Imaginationtech | 5.5 | Sep 22 | GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused |
| CVE-2025-46709 | DD Ddk Imaginationtech | 7.5 | Aug 8 | GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak |
| CVE-2025-46708 | DD Ddk Imaginationtech | 4.3 | Jun 27 | GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs |
| CVE-2025-46707 | DD Ddk Imaginationtech | 5.2 | Jun 27 | GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it |
| CVE-2025-46710 | DD Ddk Imaginationtech | 5.7 | Jun 16 | Possible kernel exceptions caused by reading and writing kernel heap data after free |
| CVE-2025-25179 | DD Ddk Imaginationtech | 7.8 | Jun 2 | GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory |
| CVE-2025-0467 | DD Ddk Imaginationtech | 8.2 | Apr 18 | GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write |
| CVE-2024-43703 | DD Ddk Imaginationtech | 8.1 | Nov 30 | GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF |
| CVE-2024-43702 | DD Ddk Imaginationtech | 8.1 | Nov 30 | GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages |
| CVE-2024-43704 | DD Ddk Imaginationtech | 8.4 | Nov 18 | GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused |
| CVE-2024-34747 | PO Powervr-gpu Imaginationtech | 7.8 | Nov 13 | In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code |
| CVE-2024-34729 | PO Powervr-gpu Imaginationtech | 7.8 | Nov 13 | In multiple locations, there is a possible arbitrary code execution due to a logic error in the code |
| CVE-2024-31337 | PO Powervr-gpu Imaginationtech | 7.8 | Nov 13 | In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation |
| CVE-2024-43701 | GD Graphics Ddk Imaginationtech | 7.8 | Oct 14 | GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices |
| CVE-2024-31336 | DD Ddk Imaginationtech | 7.8 | Sep 11 | In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper input validation |
| CVE-2024-23716 | DD Ddk Imaginationtech | 7.0 | Sep 11 | In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition |
| CVE-2024-31333 | PO Powervr-gpu Imaginationtech | 7.8 | Aug 15 | In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow |
| CVE-2024-34726 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code |
| CVE-2024-34725 | PO Powervr-gpu Imaginationtech | 7.0 | Jul 9 | In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition |
| CVE-2024-34724 | PO Powervr-gpu Imaginationtech | 7.0 | Jul 9 | In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition |
| CVE-2024-31335 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code |
| CVE-2024-31334 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code |
| CVE-2024-23698 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check |
| CVE-2024-23697 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free |
| CVE-2024-23696 | PO Powervr-gpu Imaginationtech | 7.8 | Jul 9 | In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free |
| CVE-2023-21165 | PO Powervr-gpu Imaginationtech | 7.8 | Feb 16 | In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free |
| CVE-2023-4969 | DD Ddk Imaginationtech | 6.5 | Jan 16 | GPU kernel implementations susceptible to memory leak |