CVE-2025-46707: GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
Published Jun 27, 2025
·Updated
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
Affected Software
7 affected components
Google Android
All of the following
Any of the following
Imaginationtech Ddk>=23.2<24.1
Imaginationtech Ddk=1.15-rtm
Imaginationtech Ddk=1.17-rtm
Imaginationtech Ddk=1.18-rtm
Any of the following
Google Android
Linux Linux kernel
Event History
Jun 27, 2025
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Sep 2, 2025
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-46707?
CVE-2025-46707 is considered a high-severity vulnerability due to its potential to allow unauthorized access to the GPU.
2
How do I fix CVE-2025-46707?
To mitigate CVE-2025-46707, ensure that your Google Android software is updated to the latest security patches released to address this vulnerability.
3
What potential impacts does CVE-2025-46707 have on users?
CVE-2025-46707 can lead to unauthorized control of GPU resources, which may compromise the security and functionality of the device.
4
Who is affected by CVE-2025-46707?
CVE-2025-46707 affects Google Android devices that utilize graphics processing capabilities within guest virtual machines.
5
When was CVE-2025-46707 disclosed?
CVE-2025-46707 was disclosed as part of the security bulletin for September 2025.