CVE-2025-1246

June 2, 2025, 5:32 p.m.

7.8
High

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0.

Product(s) Impacted

Vendor Product Versions
Arm
  • Bifrost Gpu Userspace Driver
  • Valhall Gpu Userspace Driver
  • Arm 5th Gen Gpu Architecture Userspace Driver
  • r18p0-r49p3, r50p0-r51p0
  • r28p0-r49p3, r50p0-r54p0
  • r41p0-r49p3, r50p0-r54p0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a arm bifrost_gpu_userspace_driver r18p0-r49p3 / / / / / / /
a arm bifrost_gpu_userspace_driver r50p0-r51p0 / / / / / / /
a arm valhall_gpu_userspace_driver r28p0-r49p3 / / / / / / /
a arm valhall_gpu_userspace_driver r50p0-r54p0 / / / / / / /
a arm arm_5th_gen_gpu_architecture_userspace_driver r41p0-r49p3 / / / / / / /
a arm arm_5th_gen_gpu_architecture_userspace_driver r50p0-r54p0 / / / / / / /

References

https://developer.arm.com/documentation/110466/latest/

Tags

CWE-119
arm-security@arm.com
2025-06-02
CVE-2025-1246

CVSS Score

7.8 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: June 2, 2025, 11:15 a.m.
Last Modified: June 2, 2025, 5:32 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

arm-security@arm.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.