Vulnerability details
CVE-2025-0468
Imagination Technologies Graphics DDK
GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)
CVSS 3.1
7.1High
Official description
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Imagination Technologies | Graphics DDK | 1.15 RTM ≤ v ≤ 24.3 RTM | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-04-04
- Last updated
- 2025-04-07
- State
- Published
- Assigner (CNA)
- imaginationtech
Exploit prediction (EPSS)
0.21%
Probability of exploitation in 30 days
12.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-280Improper Handling of Insufficient Permissions or Privileges