Mali GPU Userspace Driver allows an Out-of-Bounds access
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Arm | Valhall GPU Userspace Driver | r19p0 – r49p2; r50p0 – r53p0 | — | No fix listed | CNA |
| Arm | Arm 5th Gen GPU Architecture Userspace Driver | r41p0 – r49p2; r50p0 – r53p0 | — | No fix listed | CNA |
| Arm | Bifrost GPU Userspace Driver | r0p0 – r49p2; r50p0 – r51p0 | — | No fix listed | CNA |
- Valhall GPU Userspace Driver VendorArm Affected r19p0 – r49p2; r50p0 – r53p0 Fixed in — No fix listed CNA
- Arm 5th Gen GPU Architecture Userspace Driver VendorArm Affected r41p0 – r49p2; r50p0 – r53p0 Fixed in — No fix listed CNA
- Bifrost GPU Userspace Driver VendorArm Affected r0p0 – r49p2; r50p0 – r51p0 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arm:5th_gen_gpu_architecture_userspace_driver:*:*:*:*:*:*:*:* | r41p0 to before r49p3; r50p0 to before r54p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:bifrost_gpu_userspace_driver:*:*:*:*:*:*:*:* | r0p0 to before r49p3; r50p0 – r51p0 | Vulnerable | Arm |
| cpe:2.3:a:arm:valhall_gpu_userspace_driver:*:*:*:*:*:*:*:* | r19p0 to before r49p3; r50p0 to before r54p0 | Vulnerable | Arm |
- cpe:2.3:a:arm:5th_gen_gpu_architecture_userspace_driver:*:*:*:*:*:*:*:* Versions r41p0 to before r49p3; r50p0 to before r54p0 Vulnerable ·Arm
- cpe:2.3:a:arm:bifrost_gpu_userspace_driver:*:*:*:*:*:*:*:* Versions r0p0 to before r49p3; r50p0 – r51p0 Vulnerable ·Arm
- cpe:2.3:a:arm:valhall_gpu_userspace_driver:*:*:*:*:*:*:*:* Versions r19p0 to before r49p3; r50p0 to before r54p0 Vulnerable ·Arm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0050
- 2026-10-03 Alias added: GHSA-633m-895c-3f9g
References
More Arm 5th Gen Gpu Architecture Userspace Driver vulnerabilities
- TI-2025-01066 Mali GPU Userspace Driver allows an Out-of-Bounds access CVSS 3.1HIGH 7.8
- TI-2025-00789 Mali GPU Userspace Driver allows access to already freed memory CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-0050 · CVE Program
- CVE-2025-0050 · NVD
- FIRST EPSS
- GHSA-633m-895c-3f9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences