CVE-2025-25180

GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist

State: Published
Severity: 7.8 High
Published: Jul 14, 2025
Updated: Jul 14, 2025
Reserved: Feb 3, 2025

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-823 CWE - CWE-823: Use of Out-of-range Pointer Offset (4.17)

Affected Products

Product	Versions
Graphics DDKImagination Technologies	1.15 RTMAffected 1.17 RTMAffected 1.18 RTMAffected 23.2 RTM through 24.3 RTM1Affected 25.1 RTM1Not affected

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.