Arm

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Arm product.

RSS Feeds for Arm security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Arm products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Arm Sorted by Most Security Vulnerabilities since 2018

Arm Mbed Tls56 vulnerabilities

Arm Valhall Gpu Kernel Driver50 vulnerabilities

Arm Bifrost Gpu Kernel Driver32 vulnerabilities

Arm 5th Gen Gpu Architecture Kernel Driver23 vulnerabilities

Arm Midgard Gpu Kernel Driver18 vulnerabilities

Arm Mali Gpu Kernel Driver14 vulnerabilities

Arm Mbed6 vulnerabilities

Arm Trusted Firmware A6 vulnerabilities

Arm Trusted Firmware M6 vulnerabilities

Arm Mbed Crypto4 vulnerabilities

Arm Development Studio4 vulnerabilities

Arm Valhall Gpu Userspace Driver1 vulnerability

Arm 5th Gen Gpu Architecture Userspace Driver1 vulnerability

Arm Valhall Gpu Firmware1 vulnerability

Arm Bifrost Gpu Userspace Driver1 vulnerability

Arm 5th Gen Gpu Architecture Firmware1 vulnerability

Known Exploited Arm Vulnerabilities

The following Arm vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. CVE-2024-4610 Exploit Probability: 0.8%	June 12, 2024
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. CVE-2023-4211 Exploit Probability: 0.2%	October 3, 2023
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. CVE-2021-29256 Exploit Probability: 0.5%	July 7, 2023
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability	Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. CVE-2023-26083 Exploit Probability: 7.1%	April 7, 2023
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. CVE-2022-38181 Exploit Probability: 24.5%	March 30, 2023
Arm Mali GPU Kernel Driver Unspecified Vulnerability	Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. CVE-2022-22706 Exploit Probability: 0.1%	March 30, 2023
Arm Trusted Firmware M through 1.2 Denial-of-Service	In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. This vulnerability has known active exploitation against Yealink Device Management servers. It is assessed this product utilizes the affected Arm firmware. CVE-2021-27562 Exploit Probability: 47.9%	November 3, 2021
Arm Mali GPU Kernel Boundary Error Vulnerability	The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r8p0 through r30p0. CVE-2021-28664 Exploit Probability: 0.1%	November 3, 2021
Arm Mali GPU Kernel Use-After-Free Vulnerability	The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0. CVE-2021-28663 Exploit Probability: 2.7%	November 3, 2021

2 known exploited Arm vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 2 vulnerabilities in Arm with an average score of 5.8 out of ten. Last year, in 2025 Arm had 22 security vulnerabilities published. Right now, Arm is on track to have less security vulnerabilities in 2026 than it did last year. Interestingly, the average vulnerability score and the number of vulnerabilities for 2026 and last year was the same.

Year	Vulnerabilities	Average Score
2026	2	5.75
2025	22	5.75
2024	38	7.00
2023	27	6.44
2022	21	8.45
2021	20	7.08
2020	4	0.00
2019	2	5.30
2018	13	6.48

It may take a day or so for new Arm vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Arm Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-0995	Mar 02, 2026	Arm C1-Pro SME TLBI+DSB fails to enforce memory access completion An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME.
CVE-2025-0647	Jan 14, 2026	ARM CPU RCTX Instruction Blocks TLB Invalidation (CVE-2025-0647) In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
CVE-2025-6349	Dec 01, 2025	ARM Valhall GPU Kernel Driver Use-After-Free (CVE-2025-6349) Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.	Valhall Gpu Kernel Driver 5th Gen Gpu Architecture Kernel Driver
CVE-2025-8045	Dec 01, 2025	UseAfterFree in Arm Valhall GPU Kernel Driver (r53p0r54p1) Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.	Valhall Gpu Kernel Driver 5th Gen Gpu Architecture Kernel Driver
CVE-2025-2879	Dec 01, 2025	Arm Valhall GPU Kernel Driver: Sensitive Data Exposure via Improper GP Ops Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expose sensitive data.This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.	Valhall Gpu Kernel Driver 5th Gen Gpu Architecture Kernel Driver
CVE-2025-48507	Nov 23, 2025	ARM TF-A Bypass of Processor Security State Allows Privilege Escalation The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.	Trusted Firmware A
CVE-2025-54764	Oct 20, 2025	Mbed TLS <3.6.5 Timing Attack via mbedtls_mpi_mod_inv/gcd Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.	Mbed Tls
CVE-2025-53022	Jul 30, 2025	Stack VULN in Trusted Firmware-M 2.1.3 FWU: RCE via TLV Length Overflow TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.	Trusted Firmware M
CVE-2025-7427	Jul 22, 2025	Arm Development Studio DLL Hijacking RCE via Uncontrolled Search Path Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio.	Arm Development Studio
CVE-2025-47917	Jul 20, 2025	Mbed TLS <3.6.4 Use-After-Free in mbedtls_x509_string_to_names Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).	Mbed Tls
CVE-2025-49087	Jul 20, 2025	Mbed TLS 3.6.x Timing Leak in PKCS#7 Padding Removal Before 3.6.4 In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.	Mbed Tls
CVE-2025-48965	Jul 20, 2025	Mbed TLS <3.6.4 NULL pointer deref via mbedtls_asn1_store_named_data Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.	Mbed Tls
CVE-2025-49600	Jul 04, 2025	MbedTLS 3.3.0-3.6.4: mbedtls_lms_verify allows LMS forgery via fault In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.	Mbed Tls
CVE-2025-49601	Jul 04, 2025	MbedTLS <3.6.4: OOB Read in mbedtls_lms_import_public_key In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.	Mbed Tls
CVE-2025-52497	Jul 04, 2025	Mbed TLS before 3.6.4 PEM parsing heap buffer underflow via untrusted input Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.	Mbed Tls
CVE-2025-0073	Jun 02, 2025	Use After Free in Arm Valhall GPU Kernel Driver (CVE-2025-0073) Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0.	5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver
CVE-2025-0819	Jun 02, 2025	Use-After-Free in Arm Bifrost/Valhall GPU Drivers enables memory disclosure Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0.	5th Gen Gpu Architecture Kernel Driver Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver And others...
CVE-2025-1246	Jun 02, 2025	Arm GPU Userspace Driver Buffer Overflow via WebGL/WebGPU Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0.	5th Gen Gpu Architecture Userspace Driver Bifrost Gpu Userspace Driver Valhall Gpu Userspace Driver And others...
CVE-2025-0072	May 02, 2025	Use-After-Free in Arm Valhall GPU Kernel Driver Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.	5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver
CVE-2025-0427	May 02, 2025	UAF in Arm Bifrost/Valhall GPU Kernel Drivers Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r8p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r19p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.	5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver Bifrost Gpu Kernel Driver And others...
CVE-2025-27810	Mar 25, 2025	Mbed TLS <2.28.10 & <3.6.3: auth bypass via uninit memory in Finished msg Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.	Mbed Tls
CVE-2025-27809	Mar 25, 2025	Hostname Validation Bypass in Mbed TLS <2.28.10/3.6.3 Without set_hostname() Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.	Mbed Tls
CVE-2025-0015	Feb 03, 2025	Use-After-Free in ARM Valhall GPU Kernel Driver Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.	Valhall Gpu Kernel Driver
CVE-2024-7881	Jan 28, 2025	Privilege Escalation via Data Prefetch Engine (CVE-2024-7881) An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
CVE-2024-48982	Nov 20, 2024	MBed OS HCI Parsing Buffer Overflow Vulnerability An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.	Mbed
CVE-2024-48986	Nov 20, 2024	MBed OS HCI Parsing Buffer Overflow Vulnerability An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.	Mbed
CVE-2024-48985	Nov 20, 2024	MBed OS HCI Packet Processing Buffer Overflow Vulnerability An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier and the header length. If the allocate fails because the specified packet is too large, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header buffer, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to the buffer that is supposed to receive the contents of the packet body but which couldn't be allocated. One can then overwrite the state variable used by the function to determine which step of the parsing process is currently being executed. This advances the function to the next state, where it proceeds to copy data to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing.	Mbed
CVE-2024-48983	Nov 20, 2024	MBed OS HCI Packet Processing Integer Overflow Vulnerability An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated.	Mbed
CVE-2024-48981	Nov 20, 2024	MBed OS HCI Packet Parsing Buffer Overflow Vulnerability An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing function, hciTrSerialRxIncoming does not drop packets with invalid identifiers but also does not set a safe default for the length of unknown packets' headers, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to a not-yet-allocated buffer that is supposed to receive the contents of the packet body. One can then overwrite the state variable used by the function to determine which state of packet parsing is currently occurring. Because the buffer is allocated when the last byte of the header has been copied, the combination of having a bad header length variable that will never match the counter variable and being able to overwrite the state variable with the resulting buffer overflow can be used to advance the function to the next step while skipping the buffer allocation and resulting pointer write. The next 16 bytes from the packet body are then written wherever the corrupted data pointer is pointing.	Mbed
CVE-2024-49195	Oct 15, 2024	Mbed TLS 3.5.x-3.6.x Buffer Underrun in pkwrite (before 3.6.2) Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair	Mbed Tls
CVE-2024-45746	Oct 09, 2024	Trusted Firmware-M <= 2.1.0 Unvalidated Mailbox Arg Ptr Enables RCE An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).	Trusted Firmware M
CVE-2024-45157	Sep 05, 2024	MbedTLS <2.28.9/3.6.1 HMAC_DRBG Selection Failure An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.	Mbed Tls
CVE-2024-45158	Sep 05, 2024	Mbed TLS 3.6 Buffer Overflow in ecdsa_der_to_raw/ecdsa_raw_to_der An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)	Mbed Tls
CVE-2024-45159	Sep 05, 2024	Mbed TLS <3.6.1 TLS1.3 Optional Auth KeyUsage Bypass An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).	Mbed Tls
CVE-2023-51712	Sep 05, 2024	Trusted FirmwareM 2.0.0 Vulnerable Logging Subsystem Allows Sensitive Data Leak An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.	Trusted Firmware M
CVE-2024-45448	Sep 04, 2024	ARM Trusted Firmware Page Table Protection misconfig Vulnerability Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.	Trusted Firmware A
CVE-2024-6119	Sep 03, 2024	Mbed TLS 3.x Certificate Name Check Crash (CVE-2024-6119) Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.	Mbed Tls
CVE-2024-3655	Sep 03, 2024	Use-After-Free in Arm Bifrost/Valhall GPU Kernel Drivers Enables Local Priv Esc Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r43p0 through r49p0; Valhall GPU Kernel Driver: from r43p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r43p0 through r49p0.	5th Gen Gpu Architecture Kernel Driver Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver And others...
CVE-2023-31339	Aug 13, 2024	ARM TFM Input Validation Flaw May Enable Privileged RD and DoS Improper input validation in ARM® Trusted Firmware used in AMDs Zynq UltraScale+) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.	Trusted Firmware A
CVE-2024-4607	Aug 05, 2024	UAF in ARM Bifrost/Valhall GPU Kernel Driver (r41p0-r49p0) Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.	Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver 5th Gen Gpu Architecture Kernel Driver And others...
CVE-2024-2937	Aug 05, 2024	Use-After-Free in Arm GPU Kernel Driver (Bifrost/Valhall) Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.	Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver 5th Gen Gpu Architecture Kernel Driver And others...
CVE-2024-0153	Jul 01, 2024	Arm Valhall GPU Firmware Buffer Overflow Enables Full Memory Access Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Firmware allows a local non-privileged user to make improper GPU processing operations to access a limited amount outside of buffer bounds. If the operations are carefully prepared, then this in turn could give them access to all system memory. This issue affects Valhall GPU Firmware: from r29p0 through r46p0; Arm 5th Gen GPU Architecture Firmware: from r41p0 through r46p0.	5th Gen Gpu Architecture Firmware Valhall Gpu Firmware
CVE-2024-4610	Jun 07, 2024	Arm GPU Kernel Driver Use After Free CVE-2024-4610 (Bifrost/Valhall) Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.	Valhall Gpu Kernel Driver Bifrost Gpu Kernel Driver
CVE-2024-1067	May 03, 2024	Arm Bifrost/Valhall Kernel Driver Use-After-Free enables local memory compromise Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, there are certain combinations of the Linux Kernel and Mali GPU kernel driver configurations that would allow the GPU operations to affect the userspace memory of other processes. This issue affects Bifrost GPU Kernel Driver: from r41p0 through r47p0; Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.	5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver Bifrost Gpu Kernel Driver And others...
CVE-2023-6363	May 03, 2024	UAF in Arm Valhall GPU Kernel Driver (r41p0r47p0) Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the systems memory is carefully prepared by the user, then this in turn could give them access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.	5th Gen Gpu Architecture Kernel Driver Valhall Gpu Kernel Driver
CVE-2024-1395	May 03, 2024	Arm 5th Gen GPU Kernel Driver Local UAF CVE-2024-1395 Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the systems memory is carefully prepared by the user, then this in turn could give them access to already freed memory. This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.	5th Gen Gpu Architecture Kernel Driver
CVE-2024-0671	Apr 19, 2024	Arm GPU Kernel Driver Use-After-Free: Local Non-Privileged User Access Freed Memory Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Midgard GPU Kernel Driver: from r19p0 through r32p0; Bifrost GPU Kernel Driver: from r7p0 through r48p0; Valhall GPU Kernel Driver: from r19p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r48p0.	5th Gen Gpu Architecture Kernel Driver Bifrost Gpu Kernel Driver Midgard Gpu Kernel Driver And others...
CVE-2024-1065	Apr 19, 2024	CVE-2024-1065: Local UAF in Arm Bifrost/Valhall GPU Kernel Drivers Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0.	5th Gen Gpu Architecture Kernel Driver Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver And others...
CVE-2024-28755	Apr 03, 2024	MbedTLS 3.5.x SSL Session Reset Bug Enables TLS 1.3 Downgrade An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.	Mbed Tls
CVE-2024-28836	Apr 03, 2024	Mbed TLS 3.5.x DoS via TLS 1.2 Fallback before 3.6 An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.	Mbed Tls