CVE-2025-1246 Details
Description
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0.
A buffer overflow vulnerability has been identified in the Arm Mali GPU Userspace Drivers for Bifrost, Valhall, and 5th Gen GPU Architecture. This vulnerability allows a non-privileged user process to perform valid GPU processing operations, including through WebGL or WebGPU, and access memory outside of buffer bounds. The issue is present in multiple versions across the different GPU architectures.
Users are advised to upgrade to the latest versions of the Arm Mali GPU Userspace Drivers. The fixed versions are included in the official Arm Mali GPU Driver Security Bulletin.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://developer.arm.com/documentation/110466/latest/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| arm 5th gen gpu architecture userspace driver | >= r41p0, < r49p4 >= r50p0, < r54p1 |
CPE
Remediation
| |
| arm bifrost gpu userspace driver | >= r48p0, < r49p4 r50p0 r51p0 |
CPE
Remediation
| |
| arm valhall gpu userspace driver | >= r28p0, < r49p4 >= r50p0, < r54p1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | Initial Analysis | [email protected] |
| Jun 2, 2025 | CVE Modified | CISA-ADP |
| Jun 2, 2025 | New CVE Received | [email protected] |