Medium 5.3Published Sep 27, 2023

CVE-2023-44216PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend i…

Updated under an hour ago (Nov 2, 2026, 3:00 AM ET)

Does this affect you?

It affects canonical ubuntu_linux and 15 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for canonical ubuntu_linux Exploited in the last 30 days

PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately determine text contained on a web page from one origin if they control a resource from a different origin.

CVSS: 5.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-203
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

canonical ubuntu_linux canonical:ubuntu_linux	22.04	NVD
amd ryzen_7_4800u amd:ryzen_7_4800u	all versions	NVD
intel core_i7-10510u intel:core_i7-10510u	all versions	NVD
intel core_i7-12700k intel:core_i7-12700k	all versions	NVD
intel core_i7-8700 intel:core_i7-8700	all versions	NVD
microsoft windows_11 microsoft:windows_11	all versions; all versions	NVD
intel core_i7-10610u intel:core_i7-10610u	all versions	NVD
intel core_i7-11800h intel:core_i7-11800h	all versions	NVD
nvidia geforce_rtx_3060 nvidia:geforce_rtx_3060	all versions	NVD
microsoft windows_10 microsoft:windows_10	all versions	NVD
1–10 of 16

References

References

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/	press/media-coverage, third-party-advisory
https://blog.imaginationtech.com/introducing-pvric4-taking-image-compression-to-the-next-level/	press/media-coverage
https://blog.imaginationtech.com/reducing-bandwidth-pvric/	press/media-coverage
https://github.com/UT-Security/gpu-zip	third-party-advisory
https://news.ycombinator.com/item?id=37663159	issue-tracking
https://www.bleepingcomputer.com/news/security/modern-gpus-vulnerable-to-new-gpuzip-side-channel-attack/	press/media-coverage
https://www.hertzbleed.com/gpu.zip/	technical-description
https://www.hertzbleed.com/gpu.zip/GPU-zip.pdf	exploit
https://www.w3.org/TR/filter-effects-1/	exploit

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.