CVE-2023-44216

What it actually does

PVRIC compression on Imagination 2018+ GPUs enables cross-origin pixel stealing via SVG feTurbulence and feBlend filters, allowing an attacker-controlled origin to accurately recover pixel data or text from a different origin.

Why it matters to the business

Organizations face risk of unauthorized disclosure of sensitive web content such as login pages, documents, or user data displayed in browsers, increasing exposure to information theft without direct access.

How an attack unfolds

An attacker hosts a malicious page on one origin that loads a target page from another origin inside an iframe or object, applies SVG filters known to trigger GPU compression, and measures side-channel effects to reconstruct text or images; public exploit code is available and the issue has been known since 2023.

How to fix it

Upgrade affected packages to the fixed versions listed (openexr 3.1.13-1 on Debian 14) and apply any vendor GPU driver or firmware updates that disable or harden PVRIC compression when possible.

How to confirm the fix worked

Confirm the installed openexr package version meets or exceeds 3.1.13-1 on Debian 14 systems, verify GPU driver release notes for PVRIC or GPU.zip mitigations, and test that cross-origin SVG filter attacks no longer succeed in controlled browser environments.

Typical attack path

1. Attacker crafts a page containing SVG filters on a controlled origin
2. Victim browser loads the attacker page while the target page from a different origin is also loaded
3. GPU compression side effects are observed through timing or bandwidth measurements
4. Recovered pixel data is used to reconstruct readable text or layout from the target origin

How to detect it

Examine web server and browser logs for repeated cross-origin requests involving SVG filter elements, monitor for anomalous GPU utilization patterns during web browsing sessions, and review any available telemetry for pixel-stealing indicators; no specific post-exploitation artifacts are publicly documented.

What your security team should do

• Prioritize patching openexr and related graphics libraries within the next 30 days given public exploit availability
• Review browser and GPU configurations for any available mitigations against compression side-channels
• Monitor upstream GPU vendor advisories for additional firmware or driver fixes