# cve.now: Imagination Technologies

The newest entries naming Imagination Technologies as an affected vendor (up to 200), of 95 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-74915](https://cve.now/CVE-2026-74915.md): GPU DDK - OOB write in UntwiddlePOTSquare64bpp (CVSS 8.8)
- [CVE-2026-74912](https://cve.now/CVE-2026-74912.md): GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers \> 4GB (CVSS 9.8)
- [CVE-2026-19199](https://cve.now/CVE-2026-19199.md): GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet (CVSS 7.1)
- [CVE-2026-18629](https://cve.now/CVE-2026-18629.md): GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation (CVSS 7.5)
- [CVE-2026-65587](https://cve.now/CVE-2026-65587.md): GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE\_BASE\_LEVEL change (CVSS 5.5)
- [CVE-2026-65586](https://cve.now/CVE-2026-65586.md): GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM (CVSS 7.1)
- [CVE-2026-65584](https://cve.now/CVE-2026-65584.md): GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo (CVSS 7.8)
- [CVE-2026-15466](https://cve.now/CVE-2026-15466.md): GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() (CVSS 7.0)
- [CVE-2026-45197](https://cve.now/CVE-2026-45197.md): GPU DDK - TOCTOU affecting psFWMemContext-\>uiPageCatBaseRegSet (CVSS 2.5)
- [CVE-2026-45200](https://cve.now/CVE-2026-45200.md): GPU DDK - Double free in \_FreeOSPages due to incorrect allocation flag set by \_EncodeAllocationFlags (CVSS 7.8)
- [CVE-2026-45202](https://cve.now/CVE-2026-45202.md): GPU DDK - Silent High-Order CMA Memory Leak & Double Free in \`\_FreeOSPages\_Fast\` (CVSS 5.5)
- [CVE-2026-45201](https://cve.now/CVE-2026-45201.md): GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory (CVSS 7.8)
- [CVE-2026-45199](https://cve.now/CVE-2026-45199.md): GPU DDK - rgxfw\_to\_ptr() does not reject FW private data pointers (CVSS 7.8)
- [CVE-2026-49746](https://cve.now/CVE-2026-49746.md): GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem (CVSS 7.1)
- [CVE-2026-45204](https://cve.now/CVE-2026-45204.md): GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory (CVSS 5.5)
- [CVE-2026-45198](https://cve.now/CVE-2026-45198.md): GPU DDK - RGXFWIF\_SYSINIT::sCorememDataStore is untrusted (CVSS 7.8)
- [CVE-2026-16280](https://cve.now/CVE-2026-16280.md): GPU DDK - Integer overflow in \_PMRLogicalOffsetToPhysicalOffset (CVSS 9.8)
- [CVE-2026-49745](https://cve.now/CVE-2026-49745.md): GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 (CVSS 7.8)
- [CVE-2026-49744](https://cve.now/CVE-2026-49744.md): GPU DDK - Unchecked ui32TracePointer in rgxfw\_log\_ex() (CVSS 7.8)
- [CVE-2026-49743](https://cve.now/CVE-2026-49743.md): GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed (CVSS 7.8)
- [CVE-2026-45203](https://cve.now/CVE-2026-45203.md): GPU DDK - rgxfw\_hwperf\_ufo() re-reads psCmdHeader-\>ui32CmdSize after initial check, TOCTOU (CVSS 7.8)
- [CVE-2026-45196](https://cve.now/CVE-2026-45196.md): GPU DDK - Arbitrary GPU register write in rgxfw\_hwperf\_hw due to unsanitized pointers from host kernel (CVSS 7.8)
- [CVE-2026-7639](https://cve.now/CVE-2026-7639.md): GPU DDK - Page UAF read in PMMETA\_PROTECT heap memory (CVSS 7.8)
- [CVE-2026-41154](https://cve.now/CVE-2026-41154.md): GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages\_Sparse (CVSS 7.8)
- [CVE-2026-34196](https://cve.now/CVE-2026-34196.md): GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem (CVSS 7.8)
- [CVE-2026-45195](https://cve.now/CVE-2026-45195.md): GPU DDK - rgxfw\_set\_mips\_fault\_address(&psInit-\>sFaultPhysAddr) is untrusted (CVSS 7.8)
- [CVE-2026-21734](https://cve.now/CVE-2026-21734.md): GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation (CVSS 7.7)
- [CVE-2026-41156](https://cve.now/CVE-2026-41156.md): GPU DDK - kernel\<-\>fw CCB contains SYNC\_PRIMITIVE\_BLOCK firmware address without holding reference (CVSS 7.7)
- [CVE-2026-34192](https://cve.now/CVE-2026-34192.md): GPU DDK - \_MMU\_AllocLevel error recovery paths leave dangling page table entries (CVSS 7.7)
- [CVE-2026-41158](https://cve.now/CVE-2026-41158.md): GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink (CVSS 7.8)
- [CVE-2026-41157](https://cve.now/CVE-2026-41157.md): GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D (CVSS 9.8)
- [CVE-2026-41155](https://cve.now/CVE-2026-41155.md): GPU DDK - SharedSecMem mapped into all GPU virtual address spaces (CVSS 5.5)
- [CVE-2026-34195](https://cve.now/CVE-2026-34195.md): GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes (CVSS 8.8)
- [CVE-2026-34194](https://cve.now/CVE-2026-34194.md): GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count (CVSS 7.1)
- [CVE-2026-22164](https://cve.now/CVE-2026-22164.md): GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogical (CVSS 7.5)
- [CVE-2026-34193](https://cve.now/CVE-2026-34193.md): GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw\_to\_ptr() (CVSS 4.3)
- [CVE-2026-22166](https://cve.now/CVE-2026-22166.md): GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable (CVSS 8.1)
- [CVE-2026-22165](https://cve.now/CVE-2026-22165.md): GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs (CVSS 8.1)
- [CVE-2026-22167](https://cve.now/CVE-2026-22167.md): GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory (CVSS 7.8)
- [CVE-2026-21733](https://cve.now/CVE-2026-21733.md): GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) (CVSS 7.3)
- [CVE-2026-22163](https://cve.now/CVE-2026-22163.md): GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU (CVSS 7.8)
- [CVE-2026-21732](https://cve.now/CVE-2026-21732.md): GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation (CVSS 9.6)
- [CVE-2026-21736](https://cve.now/CVE-2026-21736.md): GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled (CVSS 4.4)
- [CVE-2025-13952](https://cve.now/CVE-2025-13952.md): GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP (CVSS 9.8)
- [CVE-2025-10865](https://cve.now/CVE-2025-10865.md): GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns (CVSS 7.8)
- [CVE-2025-58411](https://cve.now/CVE-2025-58411.md): GPU DDK - Reservation::psMappedPMR can change while used by a freelist -\> UAF (CVSS 8.8)
- [CVE-2025-58409](https://cve.now/CVE-2025-58409.md): GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory (CVSS 3.5)
- [CVE-2025-25176](https://cve.now/CVE-2025-25176.md): GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world (CVSS 9.1)
- [CVE-2025-58408](https://cve.now/CVE-2025-58408.md): GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code (CVSS 5.9)
- [CVE-2025-58407](https://cve.now/CVE-2025-58407.md): GPU DDK - TOCTOU bug affecting psFWMemContext-\>uiPageCatBaseRegSet (CVSS 7.4)
- [CVE-2025-58410](https://cve.now/CVE-2025-58410.md): GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma\_buf import PMR (CVSS 7.5)
- [CVE-2025-46711](https://cve.now/CVE-2025-46711.md): GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused (CVSS 5.5)
- [CVE-2025-25177](https://cve.now/CVE-2025-25177.md): GPU DDK - Roll-back of pvr\_exp\_fence not in finalised state can cause UAF (CVSS 5.1)
- [CVE-2025-46709](https://cve.now/CVE-2025-46709.md): GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak (CVSS 7.5)
- [CVE-2025-6573](https://cve.now/CVE-2025-6573.md): GPU DDK - RGXFW\_CTL.pui8FWScratchBuf Leak/Overwrite (CVSS 9.8)
- [CVE-2025-8109](https://cve.now/CVE-2025-8109.md): GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation (CVSS 8.8)
- [CVE-2025-25180](https://cve.now/CVE-2025-25180.md): GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist (CVSS 7.8)
- [CVE-2025-46708](https://cve.now/CVE-2025-46708.md): GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs (CVSS 4.3)
- [CVE-2025-46707](https://cve.now/CVE-2025-46707.md): GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it (CVSS 5.2)
- [CVE-2025-46710](https://cve.now/CVE-2025-46710.md): Possible kernel exceptions caused by reading and writing kernel heap data after free. (CVSS 5.7)
- [CVE-2025-25179](https://cve.now/CVE-2025-25179.md): GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory (CVSS 7.8)
- [CVE-2024-47893](https://cve.now/CVE-2024-47893.md): GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups) (CVSS 6.5)
- [CVE-2025-1706](https://cve.now/CVE-2025-1706.md): GPU DDK - Improper locking when accessing the pvr\_exp\_fence object (CVSS 7.5)
- [CVE-2025-0467](https://cve.now/CVE-2025-0467.md): GPU DDK - rgxfw\_hwperf\_get\_packet\_buffer OOB write (CVSS 8.2)
- [CVE-2025-25178](https://cve.now/CVE-2025-25178.md): GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory (CVSS 7.8)
- [CVE-2025-0468](https://cve.now/CVE-2025-0468.md): GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA) (CVSS 7.1)
- [CVE-2025-0835](https://cve.now/CVE-2025-0835.md): GPU DDK - \_WrapExtMemReleasePages called twice if \_FlushUMVirtualRange fails (CVSS 7.8)
- [CVE-2025-0478](https://cve.now/CVE-2025-0478.md): GPU DDK - PMMETA\_PROTECT PMR can be exported as dma-buf file / GEM object (CVSS 7.8)
- [CVE-2024-12837](https://cve.now/CVE-2024-12837.md): GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size (CVSS 7.8)
- [CVE-2024-12576](https://cve.now/CVE-2024-12576.md): GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address (CVSS 5.5)
- [CVE-2024-12577](https://cve.now/CVE-2024-12577.md): GPU DDK - rgxfw\_pcset\_ungrab OOB write via psFWMemContext-\>uiPageCatBaseRegSet (CVSS 7.3)
- [CVE-2024-52939](https://cve.now/CVE-2024-52939.md): GPU DDK - RGXFWIF\_HWPERF\_CTL\_BLK.uiNumCounters OOB write (CVSS 7.8)
- [CVE-2024-47896](https://cve.now/CVE-2024-47896.md): GPU DDK - rgxfw\_hwr\_log\_info OOB write via psHWRInfoBuf-\>ui32WriteIndex (CVSS 3.3)
- [CVE-2024-46975](https://cve.now/CVE-2024-46975.md): GPU DDK - rgxfw\_write\_robustness\_buffer allows arbitrary catreg set mapping (CVSS 7.9)
- [CVE-2024-47900](https://cve.now/CVE-2024-47900.md): GPU DDK - Multiple integer overflow in DmaTransfer PMR\_DevPhysAddr functions leading to OOB writes (CVSS 7.8)
- [CVE-2024-47899](https://cve.now/CVE-2024-47899.md): GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition (CVSS 7.8)
- [CVE-2024-47898](https://cve.now/CVE-2024-47898.md): GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition (CVSS 7.8)
- [CVE-2024-47891](https://cve.now/CVE-2024-47891.md): GPU DDK - Exploitable double free on PTL\_STREAM\_DESC object in the kernel function TLServerCloseStreamKM due to a race condition (CVSS 7.8)
- [CVE-2024-46974](https://cve.now/CVE-2024-46974.md): GPU DDK - Arbitrary write of read-only dmabuf (CVSS 7.8)
- [CVE-2024-52938](https://cve.now/CVE-2024-52938.md): GPU DDK - rgxfw\_pm\_add\_freelist\_for\_reconstruction OOB write (CVSS 7.8)
- [CVE-2024-52937](https://cve.now/CVE-2024-52937.md): GPU DDK - rgxfw\_kernel\_CMD\_DISABLE\_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore (CVSS 6.7)
- [CVE-2024-52936](https://cve.now/CVE-2024-52936.md): GPU DDK - rgxfw\_hwperf\_config OOB read & write (CVSS 4.4)
- [CVE-2024-52935](https://cve.now/CVE-2024-52935.md): GPU DDK - psContext-\>eDM gives OOB write (CVSS 4.1)
- [CVE-2024-47895](https://cve.now/CVE-2024-47895.md): GPU DDK - OOB read into fwlog due to unchecked block count (CVSS 7.1)
- [CVE-2024-47894](https://cve.now/CVE-2024-47894.md): GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds (CVSS 7.1)
- [CVE-2024-47897](https://cve.now/CVE-2024-47897.md): GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write (CVSS 8.8)
- [CVE-2024-43705](https://cve.now/CVE-2024-43705.md): GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so) (CVSS 7.8)
- [CVE-2024-46973](https://cve.now/CVE-2024-46973.md): Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement (CVSS 7.8)
- [CVE-2024-46972](https://cve.now/CVE-2024-46972.md): GPU DDK - Security: Reference count overflow in pvr\_sync\_rollback\_export\_fence (CVSS 7.8)
- [CVE-2024-47892](https://cve.now/CVE-2024-47892.md): GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA) (CVSS 7.8)
- [CVE-2024-46971](https://cve.now/CVE-2024-46971.md): GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems (CVSS 7.8)
- [CVE-2024-43703](https://cve.now/CVE-2024-43703.md): GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF (CVSS 8.1)
- [CVE-2024-43702](https://cve.now/CVE-2024-43702.md): GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages (CVSS 8.1)
- [CVE-2024-43704](https://cve.now/CVE-2024-43704.md): GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused (CVSS 8.4)
- [CVE-2024-43701](https://cve.now/CVE-2024-43701.md): GPU DDK - PowerVR: TLB invalidate UAF of dma\_buf imported into multiple GPU devices (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/imagination-technologies
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.