CVE-2025-0050
Mali GPU Userspace Driver allows an Out-of-Bounds access
- Published
- Updated
- Reserved
- Assigned by
- Arm
Description
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVDNVD · Analyzed | 3.1 | Medium5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
Arm Ltd · Valhall GPU Userspace Driver
- affected r19p0 – ≤ r49p2
- affected r50p0 – ≤ r53p0
Arm Ltd · Arm 5th Gen GPU Architecture Userspace Driver
- affected r41p0 – ≤ r49p2
- affected r50p0 – ≤ r53p0
Arm Ltd · Bifrost GPU Userspace Driver
- affected r0p0 – ≤ r49p2
- affected r50p0 – ≤ r51p0
What to do
Solution: This issue has been fixed in the following versions: * Bifrost GPU Userspace Driver r49p3 * Valhall GPU Userspace Driver r49p3 and r54p0 * Arm 5th Gen GPU Architecture Userspace Driver r49p3 and r54p0 Arm recommends that affected users upgrade to the latest applicable version to protect against this issue.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-0050)Record last updated .