CVE-2025-0468

GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)

At a glance

Severity: HIGH 7.1
EPSS: EPSS 0.21 % · percentile 12 (2026-10-27)
State: PUBLISHED
Published: 2025-04-04
Updated: 2025-04-07
Assigner: imaginationtech
NVD status: Deferred

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

CWE-280

European references

ENISA EUVD · EUVD-2025-9894
GCVE · GCVE-0-2025-0468

CERT-FR advisories

CERTFR-2025-AVI-0472 — Multiples vulnérabilités dans Google Android · cert.ssi.gouv.fr

Affected products

Product	Versions
Imagination Technologies · Graphics DDK	affected 1.15 RTM ≤ 24.3 RTM ; unaffected 25.1 RTM

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD