CVE-2025-13952 Details
Description
A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. The shader code contained in the web page executes a path in the compiler that held onto an out of date pointer, pointing to a freed memory object.
A write use-after-free vulnerability has been identified in the GPU shader compiler library of Imagination Technologies. This issue arises when a web page containing unusual GPU shader code is loaded into the compiler process. The shader code executes a path in the compiler that retains an outdated pointer, leading to a crash by referencing a freed memory object. On certain platforms, if the compiler process has system privileges, this vulnerability could be exploited further on the device.
The DDK compiler library has been updated to safely handle unusual GPU shader code, preventing disruptions during shader compilation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| imaginationtech ddk | < 25.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | imaginationtech |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 28, 2026 | Initial Analysis | [email protected] |
| Jan 26, 2026 | CVE Modified | CISA-ADP |
| Jan 24, 2026 | New CVE Received | imaginationtech |