CVE-2025-13952

A website containing unusual GPU shader code is loaded into the GPU compiler process. The shader code triggers an execution path in the compiler that stores an outdated pointer referencing an already freed object in memory. This results in a write to a freed memory area (write use-after-free), causing a crash of the compiler process. On platforms where the compiler process has system privileges, this memory management vulnerability can be exploited to perform further exploits on the device.

An attacker can cause a crash of the GPU compiler process, and on platforms with a privileged compiler process — potentially gain the ability to execute further exploits with system privileges, which threatens the confidentiality, integrity, and availability of the device.

Apply patches available from the manufacturer according to the references: https://www.imaginationtech.com/gpu-driver-vulnerabilities/

Imagination DDK library (GPU shader compiler library) — versions indicated in the manufacturer's references