CVE-2025-25178 — Improper Validation of Specified Quantity in Input in Technologies Graphics DDK

CWE-1284 — Improper Validation of Specified Quantity in InputCWE-125 — Out-of-bounds Read4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 74.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Imagination Technologies Graphics DDKGoogle AndroidMsrc Azl3 Sysbench 1.0.20-5 ON Azure Linux 3.0+4 more
Timeline
PublishedApr 4
Latest updateJul 8

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5imagination_technologies/graphics_ddk1.15 RTM — 24.3 RTM

🔴Vulnerability Details

1
GHSA
GHSA-cmcg-w67x-52f7: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption↗2025-04-04
▶

📋Vendor Advisories

2
Microsoft
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.↗2025-07-08
▶
Android
CVE-2025-25178: PowerVR-GPU↗2025-06-01
▶