GPU DDK - OOB write in UntwiddlePOTSquare64bpp
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is the GPU graphics driver's user-space shared library used by the GPU GLES render process, which handles WebGPU content from web pages. A specially crafted web page can cause this library to read or write memory out of bounds, crashing the process, and on certain platforms, when that process runs with system privileges, this could enable further attacks on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Imagination Technologies Graphics DDK
From 25.1 RTM2 · through 25.3 RTM