Read the docs
TI-2023-23747 Aliases CVE-2023-44216GHSA-fjqr-32v8-6gf9

PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers…

Priority MEDIUM 57CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0172 77th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*22.04VulnerableCanonical
cpe:2.3:h:amd:ryzen_7_4800u:-:*:*:*:*:*:*:*not specified by NVDVulnerableAMD
cpe:2.3:h:intel:core_i7-10510u:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:core_i7-12700k:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:core_i7-8700:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:o:microsoft:windows_11:-:*:*:*:professional:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:h:intel:core_i7-10610u:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:o:microsoft:windows_11:-:*:*:*:home:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:h:intel:core_i7-11800h:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:nvidia:geforce_rtx_3060:-:*:*:*:*:*:*:*not specified by NVDVulnerableNVIDIA
  • cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
  • cpe:2.3:h:amd:ryzen_7_4800u:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
  • cpe:2.3:h:intel:core_i7-10510u:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:core_i7-12700k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:core_i7-8700:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:o:microsoft:windows_11:-:*:*:*:professional:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:h:intel:core_i7-10610u:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:o:microsoft:windows_11:-:*:*:*:home:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:h:intel:core_i7-11800h:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:nvidia:geforce_rtx_3060:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10:-:*:*:*:pro:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:h:amd:ryzen_5_7600x:-:*:*:*:*:*:*:*not specified by NVDVulnerableAMD
cpe:2.3:h:nvidia:geforce_rtx_2080_super:-:*:*:*:*:*:*:*not specified by NVDVulnerableNVIDIA
cpe:2.3:o:apple:macos:13.1:*:*:*:*:*:*:*13.1VulnerableApple
cpe:2.3:h:apple:m1_mac_mini:-:*:*:*:*:*:*:*not specified by NVDVulnerableApple
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*13.0VulnerableGoogle
cpe:2.3:h:google:pixel_6:-:*:*:*:*:*:*:*not specified by NVDVulnerableGoogle
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:pro:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:h:amd:ryzen_5_7600x:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
  • cpe:2.3:h:nvidia:geforce_rtx_2080_super:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
  • cpe:2.3:o:apple:macos:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·Apple
  • cpe:2.3:h:apple:m1_mac_mini:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apple
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Google
  • cpe:2.3:h:google:pixel_6:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Google

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-44216
  2. 2026-10-03 Alias added: GHSA-fjqr-32v8-6gf9

References

Exploit 2

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences