EUVD-2026-72799
GHSA-f8xc-7843-7v29
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local userspace driver; any unprivileged process (PR:L) can submit GPU commands; WebGL/WebGPU access is user-level; no scope change from userspace driver compromise.
Primary rating from Vendor (Arm).
CVSS VectorVendor: Arm
Lifecycle Timeline
4DescriptionCVE.org
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory.
This issue affects Bifrost GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p3; Valhall GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0.
AnalysisAI
Use-after-free memory corruption in Arm's Bifrost, Valhall, and 5th Gen GPU userspace drivers allows a local non-privileged process - including through browser-exposed WebGL or WebGPU operations - to access already-freed memory regions, achieving full confidentiality, integrity, and availability impact. The flaw spans driver revisions from r42p0 through r55p0 across all three GPU families, covering a substantial portion of the Android Mali GPU ecosystem deployed in MediaTek and Samsung Exynos SoCs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must have an Arm Bifrost, Valhall, or 5th Gen GPU with a userspace driver revision within the affected ranges (r42p0-r51p0 or r54p1-r54p3 for Bifrost; r42p0-r54p3 or r55p0 for Valhall and 5th Gen). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation by an unprivileged process with no user interaction required, and the C:H/I:H/A:H impact cluster indicates potential arbitrary memory read/write and code execution within the affected process context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched driver revision; the Arm security advisory at https://support.arm.com/documentation/111552/1-0/?lang=en should be consulted for exact fixed revision numbers, as the provided data specifies only affected ranges (no explicit fixed version was extractable from the input). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all organizational Android devices using affected Samsung Exynos or MediaTek SoCs; subscribe to Arm and device manufacturer security bulletins for patch notifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bifrost Gpu Userspace Driver
View allBuffer over-read vulnerability in Arm GPU userspace drivers (Bifrost, Valhall, and 5th Gen architectures) that allows un
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace D
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today