CVE-2023-35659 is a high severity (CVSS 7.8) flaw in the PowerVR GPU driver used on some Android devices, caused by a logic error in DevmemIntChangeSparse in devicemem_server.c. It can lead to local privilege escalation in the kernel. The Android Security Bulletin for November 2024 lists it under the 2024-11-05 patch level.
What's affected
The record lists Android as the affected product and describes a flaw in DevmemIntChangeSparse in devicemem_server.c. The Android Security Bulletin for November 2024 places it in the PowerVR-GPU component, which comes from Imagination Technologies, and gives the severity as High. The record scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Bulletin and record agree on High.
The bulletin lists the fix under the 2024-11-05 security patch level, not the 2024-11-01 level, and says devices on 2024-11-05 or later include all earlier fixes. The record does not name a CWE for this CVE, so we do not assign one. The record's KEV flag is false, and the bulletin's note on limited, targeted exploitation names a different CVE only.
How to check if you're exposed
Only devices that use a PowerVR GPU are in scope, and the vendor builds decide that, so start with the patch level.
- On the device, open Settings, About phone, Android version and read the Android security update date. You want 2024-11-05 or later.
- For managed fleets, run adb shell getprop ro.build.version.security_patch on a test device, or read the same field from your mobile device management console.
- If a device is below 2024-11-05, check your handset maker's own bulletin, because vendors ship these fixes on their own schedule.
The bulletin says further details are available directly from Imagination Technologies.
What to do now
- Install the November 2024 security update, patch level 2024-11-05 or later, on every supported device.
- For devices that no longer receive updates, retire them from sensitive work or replace them.
- Enforce a minimum patch level in your mobile management policy so lagging devices lose access to company data.
- Report the fleet's patch level distribution to whoever owns mobile risk, so the gap is visible.
Why it matters
This weakness sits in kernel code that talks to the GPU. A bug in that path runs with the highest privileges on the phone. The description says no additional execution privileges are needed and no user interaction is required, so a malicious app already on the device is the typical starting point for this class of flaw.
That is why a local-only vector still scores 7.8. A low privileged app that escapes into the kernel can read data from other apps and change device settings. The practical defence is a current patch level plus careful control of which apps are installed.
Quick check
Is CVE-2023-35659 known to be exploited?
The record's KEV flag is false and the bulletin's exploitation note does not name this CVE. Treat it as unexploited but patch on schedule.
Which patch level fixes it?
The Android Security Bulletin for November 2024 lists it under 2024-11-05. Check your device maker's own bulletin for the exact build.
Sources
Last reviewed: 19 October 2026.
