Arm Mali Graphics Processing Unit (GPU) known exploited vulnerabilities, ranked
CISA lists 6 Arm Mali Graphics Processing Unit (GPU) CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2022-38181: EPSS 14.1%, added 2023-03-30
- CVE-2021-28663: EPSS 12.1%, added 2021-11-03
- CVE-2021-28664: EPSS 5.4%, added 2021-11-03
- CVE-2021-29256: EPSS 3.0%, added 2023-07-07
- CVE-2023-26083: EPSS 1.2%, added 2023-04-07
All 6 Arm Mali Graphics Processing Unit (GPU) CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2022-38181 | Mali GPU Kernel Driver Use-After-Free | 14.1% | – | 2023-03-30 | 2023-04-20 |
| 2 | CVE-2021-28663 | Mali Graphics Processing Unit (GPU) Use-After-Free | 12.1% | – | 2021-11-03 | 2021-11-17 |
| 3 | CVE-2021-28664 | Mali Graphics Processing Unit (GPU) Unspecified | 5.4% | – | 2021-11-03 | 2021-11-17 |
| 4 | CVE-2021-29256 | Mali GPU Kernel Driver Use-After-Free | 3.0% | – | 2023-07-07 | 2023-07-28 |
| 5 | CVE-2023-26083 | Mali GPU Kernel Driver Information Disclosure | 1.2% | – | 2023-04-07 | 2023-04-28 |
| 6 | CVE-2022-22706 | Mali GPU Kernel Driver Unspecified | 1.1% | – | 2023-03-30 | 2023-04-20 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Arm KEV CVEs · free KEV badge for Arm · all vendors