CVE-2025-58408

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.imaginationtech.com/gpu-driver-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para desencadenar lecturas de datos obsoletos que pueden conducir a excepciones del kernel y escritura de uso después de liberación. La enumeración de vulnerabilidades comunes de Uso Después de Liberación se eligió porque los datos obsoletos pueden incluir manejadores a recursos en los que los recuentos de referencia pueden desequilibrarse. Esto puede conducir a la destrucción prematura de un recurso mientras está en uso.

Information

Published : 2025-12-01 12:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-58408

Mitre link : CVE-2025-58408

CVE.ORG link : CVE-2025-58408

JSON object : View

Products Affected

imaginationtech

ddk

CWE

CWE-416

Use After Free

{"id": "CVE-2025-58408", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58408", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T18:06:06.234397Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}]}, "affected": [{"source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "affectedData": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "versions": [{"status": "affected", "version": "1.15 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.17 RTM", "versionType": "custom"}, {"status": "affected", "version": "1.18 RTM", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM", "versionType": "custom", "lessThanOrEqual": "25.2 RTM2"}, {"status": "unaffected", "version": "25.3 RTM", "versionType": "custom"}], "platforms": ["Linux", "Android"], "defaultStatus": "unknown"}]}], "published": "2025-12-01T12:15:46.570", "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free.\n\nThe Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use."}, {"lang": "es", "value": "El software instalado y ejecutado como un usuario no privilegiado puede realizar llamadas al sistema de GPU impropias para desencadenar lecturas de datos obsoletos que pueden conducir a excepciones del kernel y escritura de uso despu\u00e9s de liberaci\u00f3n.\n\nLa enumeraci\u00f3n de vulnerabilidades comunes de Uso Despu\u00e9s de Liberaci\u00f3n se eligi\u00f3 porque los datos obsoletos pueden incluir manejadores a recursos en los que los recuentos de referencia pueden desequilibrarse. Esto puede conducir a la destrucci\u00f3n prematura de un recurso mientras est\u00e1 en uso."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imaginationtech:ddk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D75CD5B-2B2E-44C9-8422-D808630103B4", "versionEndIncluding": "25.2"}], "operator": "OR"}]}], "sourceIdentifier": "367425dc-4d06-4041-9650-c2dc6aaa27ce"}