Arm vulnerabilities
We track 62 vulnerabilities in Arm products across 60+ products. 60 are rated high or critical, and 8 have been exploited in real attacks. The most recent was published on September 8, 2026.
Latest Arm vulnerabilities
- 7.8 High severity
Valhall GPU Kernel Driver: Improper Restriction of Operations within the Bounds of a Memory Buffer
A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.
- 5.5 Medium severity
Arm Mali GPU Kernel Driver Use-After-Free Exploited
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
- 7.8 High severity
Arm Compiler 5 (AC5), Arm Compiler for…: Uncontrolled Search Path Element
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- 7.8 High severity
Arm Compiler 5 (AC5), Arm Compiler for…: Incorrect Default Permissions
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- 7.8 High severity
Arm Compiler 5 (AC5), Arm Compiler for…: Incorrect Default Permissions
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
- 3.3 Low severity
Arm Mali GPU Kernel Driver Information Disclosure Exploited
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver a
- 8.8 High severity
Avalon GPU Kernel Driver: Use After Free
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r39p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.
- 8.8 High severity
Avalon GPU Kernel Driver: Use After Free
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r0p0 through r32p0, Bifrost r0p0 through r41p0 before r42p0, Valhall r19p0
- 8.8 High severity
Bifrost GPU Kernel Driver: Use After Free
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r13p0 through r32p0, Bifrost r1p0 through r40p0
- 7.5 High severity
Cortex-a53 Firmware: Observable Discrepancy
The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by o
- 9.8 Critical severity
Mbed TLS: Out-of-bounds Read
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OU
- 8.8 High severity
Valhall GPU Kernel Driver: Use After Free
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r40P0.
- 7.5 High severity
Utgard GPU Kernel Driver: Time-of-check Time-of-use (TOCTOU) Race Condition
An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access to already freed memory.
- 8.8 High severity
Valhall GPU Kernel Driver: Write-what-where Condition
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-only memory, or obtain access to already freed memory. This affects Valhall r29p0 through r38p1 before r
- 8.8 High severity
Arm Mali GPU Kernel Driver Use-After-Free Exploited
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
- 9.1 Critical severity
Mbed TLS: Out-of-bounds Read
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a
- 9.8 Critical severity
Bifrost GPU Kernel Driver: Use After Free
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0.
- 9.8 Critical severity
Bifrost GPU Kernel Driver: Use After Free
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.
- 7.8 High severity
Arm Mali GPU Kernel Driver Unspecified Exploited
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
- 8.8 High severity
Arm Mali GPU Kernel Driver Use-After-Free Exploited
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and
- 8.8 High severity
Arm Mali Graphics Processing Unit (GPU) Unspecified Exploited
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29
- 8.8 High severity
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Exploited
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and