CVE-2025-1246: Arm GPU Userspace Driver Buffer Overflow

CVE-2025-1246 Overview

CVE-2025-1246 is an out-of-bounds memory access vulnerability affecting Arm Mali GPU userspace drivers across the Bifrost, Valhall, and 5th Gen GPU architectures. The flaw stems from improper restriction of operations within the bounds of a memory buffer [CWE-119]. A non-privileged local user process can issue valid GPU processing operations, including through WebGL or WebGPU, to read or write memory outside allocated buffer boundaries. Successful exploitation grants high-impact compromise of confidentiality, integrity, and availability on affected systems. The vulnerability is locally exploitable and does not require user interaction, making browser-driven attack surfaces through WebGL and WebGPU particularly relevant.

Critical Impact
A local, low-privileged process can leverage GPU processing operations, including web-driven WebGL and WebGPU workloads, to access memory outside buffer bounds and compromise device integrity.

Affected Products

Arm Bifrost GPU Userspace Driver: r18p0 through r49p3, and r50p0 through r51p0
Arm Valhall GPU Userspace Driver: r28p0 through r49p3, and r50p0 through r54p0
Arm 5th Gen GPU Architecture Userspace Driver: r41p0 through r49p3, and r50p0 through r54p0

Discovery Timeline

2025-06-02 - CVE-2025-1246 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1246

Vulnerability Analysis

The vulnerability resides in the Arm Mali GPU userspace driver components that mediate between user-mode processes and the GPU. Because GPU command submission is accessible to unprivileged processes, and browsers expose GPU functionality through WebGL and WebGPU, the attack surface extends beyond native applications to any web content the user renders. An attacker who triggers the flaw can read or corrupt memory adjacent to the intended buffer, enabling information disclosure or memory corruption that can be chained to elevate privileges on the local system. Because Arm Mali drivers ship in a large portion of Android devices and Chromebooks, the population of exposed endpoints is substantial.

Root Cause

The root cause is improper enforcement of buffer boundary constraints when the userspace driver processes GPU work items. Certain valid GPU processing operations do not correctly validate offsets, sizes, or indices before dereferencing memory, allowing out-of-bounds access [CWE-119]. Arm's advisory identifies the flaw across the Bifrost, Valhall, and 5th Gen driver lines that share overlapping code paths.

Attack Vector

Exploitation requires local access with low privileges but no user interaction. An attacker executes a crafted process, or delivers malicious content via a web page invoking WebGL or WebGPU, and issues a sequence of GPU commands that trigger the boundary violation. The resulting memory disclosure or corruption can be used to read secrets from adjacent allocations, defeat memory protections, or stage a kernel privilege escalation.

No verified public exploit code is available at this time. See the Arm Developer Documentation for technical details.

Detection Methods for CVE-2025-1246

Indicators of Compromise

Unexpected crashes or SIGSEGV faults originating from Mali userspace driver libraries such as libGLES_mali.so
Anomalous GPU command submission patterns from unprivileged processes, especially those spawned by browser renderer sandboxes
Kernel logs referencing Mali kbase faults, MMU faults, or job slot errors correlated with untrusted web content

Detection Strategies

Inventory endpoints for Arm Mali driver versions in the vulnerable ranges and flag any device still running r18p0 through r51p0 (Bifrost), r28p0 through r54p0 (Valhall), or r41p0 through r54p0 (5th Gen)
Correlate browser process telemetry with GPU driver crash signatures to identify potential WebGL or WebGPU exploitation attempts
Hunt for post-exploitation behavior such as unexpected privilege escalation, new persistence, or credential access following GPU driver faults

Monitoring Recommendations

Enable and centralize kernel and userspace driver crash telemetry from Android and Linux endpoints using Arm Mali GPUs
Monitor for chained behavior where a browser or sandboxed process is followed by privileged actions on the same host
Track vendor firmware and driver update advisories from device OEMs to confirm patched driver versions are deployed

How to Mitigate CVE-2025-1246

Immediate Actions Required

Identify all devices running affected Arm Mali GPU userspace driver versions and prioritize them for patching
Apply the fixed driver release provided by Arm or the downstream OEM as soon as it is available for the device platform
Restrict execution of untrusted local code and limit browsing of untrusted content on unpatched devices

Patch Information

Arm has published guidance in the Arm Mali GPU security advisory documentation. Fixed driver versions are delivered through device OEMs and platform vendors. Administrators should confirm the deployed driver is later than r51p0 for Bifrost and later than r54p0 for Valhall and 5th Gen GPU Architecture lines.

Workarounds

Disable WebGL and WebGPU in browsers on affected devices where feasible, reducing exposure to web-driven exploitation
Enforce application allowlisting to prevent unprivileged local execution of untrusted binaries that could invoke the GPU driver
Isolate high-value users on hardware not affected by the vulnerable Mali driver ranges until patches are deployed

bash

# Verify Mali userspace driver version on Android/Linux endpoints
strings /vendor/lib64/egl/libGLES_mali.so | grep -Ei 'r[0-9]+p[0-9]+'

# Chromium-based browser flag to disable WebGPU as a temporary mitigation
google-chrome --disable-features=WebGPU,Vulkan