Arm known exploited vulnerabilities
CISA lists 9 Arm CVEs as exploited in the wild. 0 were added in the last 12 months (latest 2024-06-12), and 0 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2022-38181 (Mali Graphics Processing Unit (GPU)): EPSS 13.6%, added 2023-03-30
- CVE-2021-28663 (Mali Graphics Processing Unit (GPU)): EPSS 12.1%, added 2021-11-03
- CVE-2021-28664 (Mali Graphics Processing Unit (GPU)): EPSS 5.4%, added 2021-11-03
- CVE-2021-27562 (Trusted Firmware): EPSS 3.1%, added 2021-11-03
- CVE-2021-29256 (Mali Graphics Processing Unit (GPU)): EPSS 3.0%, added 2023-07-07
Most affected Arm products
Mali Graphics Processing Unit (GPU) (6), Mali GPU Kernel Driver (2), Trusted Firmware (1).
All Arm CVEs in KEV
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2024-4610 | Mali GPU Kernel Driver | Mali GPU Kernel Driver Use-After-Free | 2024-06-12 | 2024-07-03 | 0.8% | – |
| CVE-2023-4211 | Mali GPU Kernel Driver | Mali GPU Kernel Driver Use-After-Free | 2023-10-03 | 2023-10-24 | 1.1% | – |
| CVE-2021-29256 | Mali Graphics Processing Unit (GPU) | Mali GPU Kernel Driver Use-After-Free | 2023-07-07 | 2023-07-28 | 3.0% | – |
| CVE-2023-26083 | Mali Graphics Processing Unit (GPU) | Mali GPU Kernel Driver Information Disclosure | 2023-04-07 | 2023-04-28 | 1.2% | – |
| CVE-2022-38181 | Mali Graphics Processing Unit (GPU) | Mali GPU Kernel Driver Use-After-Free | 2023-03-30 | 2023-04-20 | 13.6% | – |
| CVE-2022-22706 | Mali Graphics Processing Unit (GPU) | Mali GPU Kernel Driver Unspecified | 2023-03-30 | 2023-04-20 | 1.1% | – |
| CVE-2021-28664 | Mali Graphics Processing Unit (GPU) | Mali Graphics Processing Unit (GPU) Unspecified | 2021-11-03 | 2021-11-17 | 5.4% | – |
| CVE-2021-28663 | Mali Graphics Processing Unit (GPU) | Mali Graphics Processing Unit (GPU) Use-After-Free | 2021-11-03 | 2021-11-17 | 12.1% | – |
| CVE-2021-27562 | Trusted Firmware | Trusted Firmware Out-of-Bounds Write | 2021-11-03 | 2021-11-17 | 3.1% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · All vendors