CVE-2025-25176 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
Attackers can leak intermediate GPU register values from secure workloads to non-secure environments, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-25176?
CVE-2025-25176 is a critical vulnerability in Imagination Technologies Graphics DDK, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
Weakness: CWE-668
Which versions are affected by CVE-2025-25176?
It affects 1 product.
Products include Imaginationtech Ddk.
How do I fix CVE-2025-25176?
No fix has been published for CVE-2025-25176 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-25176 being exploited?
There is no known exploitation of CVE-2025-25176 in the wild and no public exploit code.
Other vulnerabilities in Imagination Technologies Graphics DDK
- CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
- CVE-2025-13952 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
- CVE-2026-21732 GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation
- CVE-2025-58411 GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
- CVE-2025-0467 GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
Sources
Also known as GHSA-g4x2-4cxv-hpg5.