# Arm vulnerabilities

> Arm has 155 published vulnerabilities across 130 products in our catalogue. 9 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Mbed TLS, with 58. If you run Arm software, patch the exploited flaws first.

Canonical page: https://www.precursorintelligence.com/vendors/arm

## At a glance

- **Published vulnerabilities:** 155
- **Known to be exploited:** 9
- **Products:** 130
- **Versions:** 674
- **Most recently added to the known-exploited list:** [CVE-2024-4610](https://www.precursorintelligence.com/what-is/cve-2024-4610), 12 June 2024. We keep watching the list.

## Which Arm products have the most vulnerabilities?

- [Mbed TLS](https://www.precursorintelligence.com/product/arm/mbed_tls): 58 published vulnerabilities, 142 versions
- [Valhall GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/valhall_gpu_kernel_driver): 44 published vulnerabilities, 38 versions
- [Bifrost GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/bifrost_gpu_kernel_driver): 30 published vulnerabilities, 38 versions
- [Midgard GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/midgard_gpu_kernel_driver): 18 published vulnerabilities, 16 versions
- [5th Gen GPU Architecture Kernel Driver](https://www.precursorintelligence.com/product/arm/5th_gen_gpu_architecture_kernel_driver): 17 published vulnerabilities, 21 versions
- [Mbed OS](https://www.precursorintelligence.com/product/arm/mbed_os): 7 published vulnerabilities, 3 versions
- [Cortex-A72](https://www.precursorintelligence.com/product/arm/cortex-a72): 7 published vulnerabilities, 0 versions
- [Avalon GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/avalon_gpu_kernel_driver): 6 published vulnerabilities, 3 versions
- [Cortex-a](https://www.precursorintelligence.com/product/arm/cortex-a): 6 published vulnerabilities, 10 versions
- [Cortex-A57](https://www.precursorintelligence.com/product/arm/cortex-a57): 5 published vulnerabilities, 0 versions

Each product page lists its own known-exploited flaws.

## Which Arm vulnerabilities are being exploited?

9 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2024-4610](https://www.precursorintelligence.com/what-is/cve-2024-4610): Arm Mali GPU Kernel Driver Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 0.8%, known exploited since 12 June 2024.
- [CVE-2023-4211](https://www.precursorintelligence.com/what-is/cve-2023-4211): Arm Mali GPU Kernel Driver Use-After-Free Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 1.1%, known exploited since 3 October 2023.
- [CVE-2021-29256](https://www.precursorintelligence.com/what-is/cve-2021-29256): Arm Mali GPU Kernel Driver Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 3.0%, known exploited since 7 July 2023.
- [CVE-2023-26083](https://www.precursorintelligence.com/what-is/cve-2023-26083): Arm Mali GPU Kernel Driver Information Disclosure Vulnerability. Low, CVSS 3.3, chance of use in 30 days 1.2%, known exploited since 7 April 2023.
- [CVE-2022-38181](https://www.precursorintelligence.com/what-is/cve-2022-38181): Arm Mali GPU Kernel Driver Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 14%, known exploited since 30 March 2023.
- [CVE-2022-22706](https://www.precursorintelligence.com/what-is/cve-2022-22706): Arm Mali GPU Kernel Driver Unspecified Vulnerability. High, CVSS 7.8, chance of use in 30 days 1.1%, known exploited since 30 March 2023.
- [CVE-2021-28664](https://www.precursorintelligence.com/what-is/cve-2021-28664): Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability. High, CVSS 8.8, chance of use in 30 days 5.4%, known exploited since 3 November 2021.
- [CVE-2021-28663](https://www.precursorintelligence.com/what-is/cve-2021-28663): Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 12%, known exploited since 3 November 2021.
- [CVE-2021-27562](https://www.precursorintelligence.com/what-is/cve-2021-27562): Arm Trusted Firmware Out-of-Bounds Write Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 3.1%, known exploited since 3 November 2021.

## Which Arm flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2017-5753](https://www.precursorintelligence.com/what-is/cve-2017-5753): 94%, Medium (CVSS 5.6)
- [CVE-2017-5754](https://www.precursorintelligence.com/what-is/cve-2017-5754): 84%, Medium (CVSS 5.6)
- [CVE-2017-5715](https://www.precursorintelligence.com/what-is/cve-2017-5715): 74%, Medium (CVSS 5.6)
- [CVE-2018-3639](https://www.precursorintelligence.com/what-is/cve-2018-3639): 61%, Medium (CVSS 5.5)
- [CVE-2022-38181](https://www.precursorintelligence.com/what-is/cve-2022-38181): 14%, High (CVSS 8.8), known exploited
- [CVE-2021-28663](https://www.precursorintelligence.com/what-is/cve-2021-28663): 12%, High (CVSS 8.8), known exploited
- [CVE-2018-3693](https://www.precursorintelligence.com/what-is/cve-2018-3693): 8.6%, Medium (CVSS 5.6)
- [CVE-2018-3640](https://www.precursorintelligence.com/what-is/cve-2018-3640): 7.5%, Medium (CVSS 5.6)
- [CVE-2021-28664](https://www.precursorintelligence.com/what-is/cve-2021-28664): 5.4%, High (CVSS 8.8), known exploited
- [CVE-2018-0488](https://www.precursorintelligence.com/what-is/cve-2018-0488): 4.8%, Critical (CVSS 9.8)

## All Arm products we track

51 products with at least one tracked version, most vulnerabilities first:

- [Mbed TLS](https://www.precursorintelligence.com/product/arm/mbed_tls): 58 vulnerabilities, 142 versions
- [Valhall GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/valhall_gpu_kernel_driver): 44 vulnerabilities, 38 versions
- [Bifrost GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/bifrost_gpu_kernel_driver): 30 vulnerabilities, 38 versions
- [Midgard GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/midgard_gpu_kernel_driver): 18 vulnerabilities, 16 versions
- [5th Gen GPU Architecture Kernel Driver](https://www.precursorintelligence.com/product/arm/5th_gen_gpu_architecture_kernel_driver): 17 vulnerabilities, 21 versions
- [Mbed OS](https://www.precursorintelligence.com/product/arm/mbed_os): 7 vulnerabilities, 3 versions
- [Avalon GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/avalon_gpu_kernel_driver): 6 vulnerabilities, 3 versions
- [Cortex-a](https://www.precursorintelligence.com/product/arm/cortex-a): 6 vulnerabilities, 10 versions
- [Cortex-A77 Firmware](https://www.precursorintelligence.com/product/arm/cortex-a77_firmware): 5 vulnerabilities, 2 versions
- [Mali GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/mali_gpu_kernel_driver): 4 vulnerabilities, 5 versions
- [Trusted Firmware-M](https://www.precursorintelligence.com/product/arm/trusted_firmware-m): 4 vulnerabilities, 15 versions
- [Mbed Crypto](https://www.precursorintelligence.com/product/arm/mbed_crypto): 4 vulnerabilities, 9 versions
- [Ds Development Studio](https://www.precursorintelligence.com/product/arm/ds_development_studio): 3 vulnerabilities, 3 versions
- [Arm7](https://www.precursorintelligence.com/product/arm/arm7): 3 vulnerabilities, 1 version
- [Arm Compiler](https://www.precursorintelligence.com/product/arm/arm_compiler): 3 vulnerabilities, 18 versions
- [Adaptive Scalable Texture Compression Encoder](https://www.precursorintelligence.com/product/arm/adaptive_scalable_texture_compression_encoder): 2 vulnerabilities, 18 versions
- [Arm Trusted Firmware](https://www.precursorintelligence.com/product/arm/arm_trusted_firmware): 2 vulnerabilities, 2 versions
- [Arm-Trusted-Firmware](https://www.precursorintelligence.com/product/arm/arm-trusted-firmware): 2 vulnerabilities, 17 versions
- [Arm Compiler for Functional Safety](https://www.precursorintelligence.com/product/arm/arm_compiler_for_functional_safety): 2 vulnerabilities, 2 versions
- [Arm Compiler for Embedded Fusa](https://www.precursorintelligence.com/product/arm/arm_compiler_for_embedded_fusa): 2 vulnerabilities, 1 version
- [Trusted Firmware-a](https://www.precursorintelligence.com/product/arm/trusted_firmware-a): 2 vulnerabilities, 58 versions
- [Mbed](https://www.precursorintelligence.com/product/arm/mbed): 1 vulnerability, 118 versions
- [Aarch64cryptolib](https://www.precursorintelligence.com/product/arm/aarch64cryptolib): 1 vulnerability, 1 version
- [Avalon Android Gralloc Module](https://www.precursorintelligence.com/product/arm/avalon_android_gralloc_module): 1 vulnerability, 1 version
- [Bifrost Android Gralloc Module](https://www.precursorintelligence.com/product/arm/bifrost_android_gralloc_module): 1 vulnerability, 2 versions
- [Cmsis-Rtos](https://www.precursorintelligence.com/product/arm/cmsis-rtos): 1 vulnerability, 5 versions
- [Cortex-M33 Firmware](https://www.precursorintelligence.com/product/arm/cortex-m33_firmware): 1 vulnerability, 2 versions
- [Cortex-M35p Firmware](https://www.precursorintelligence.com/product/arm/cortex-m35p_firmware): 1 vulnerability, 1 version
- [Cortex-M55 Firmware](https://www.precursorintelligence.com/product/arm/cortex-m55_firmware): 1 vulnerability, 2 versions
- [Cortex-R](https://www.precursorintelligence.com/product/arm/cortex-r): 1 vulnerability, 2 versions
- [Linaro Forge](https://www.precursorintelligence.com/product/arm/linaro_forge): 1 vulnerability, 1 version
- [5th Gen GPU Architecture Firmware](https://www.precursorintelligence.com/product/arm/5th_gen_gpu_architecture_firmware): 1 vulnerability, 3 versions
- [Mbed-Coap](https://www.precursorintelligence.com/product/arm/mbed-coap): 1 vulnerability, 1 version
- [Mbed-Mqtt](https://www.precursorintelligence.com/product/arm/mbed-mqtt): 1 vulnerability, 1 version
- [Mbed Ualloc](https://www.precursorintelligence.com/product/arm/mbed_ualloc): 1 vulnerability, 1 version
- [Midguard GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/midguard_gpu_kernel_driver): 1 vulnerability, 7 versions
- [Nn Android Neural Networks Driver](https://www.precursorintelligence.com/product/arm/nn_android_neural_networks_driver): 1 vulnerability, 27 versions
- [Utgard GPU Kernel Driver](https://www.precursorintelligence.com/product/arm/utgard_gpu_kernel_driver): 1 vulnerability, 2 versions
- [Valhall Android Gralloc Module](https://www.precursorintelligence.com/product/arm/valhall_android_gralloc_module): 1 vulnerability, 2 versions
- [Valhall GPU Firmware](https://www.precursorintelligence.com/product/arm/valhall_gpu_firmware): 1 vulnerability, 3 versions
- [Cortex-35p Firmware](https://www.precursorintelligence.com/product/arm/cortex-35p_firmware): 0 vulnerabilities, 1 version
- [Bifrost GPU Userspace Driver](https://www.precursorintelligence.com/product/arm/bifrost_gpu_userspace_driver): 0 vulnerabilities, 7 versions
- [5th Gen GPU Architecture Userspace Driver](https://www.precursorintelligence.com/product/arm/5th_gen_gpu_architecture_userspace_driver): 0 vulnerabilities, 6 versions
- [Scp Firmware](https://www.precursorintelligence.com/product/arm/scp_firmware): 0 vulnerabilities, 13 versions
- [Bifrost](https://www.precursorintelligence.com/product/arm/bifrost): 0 vulnerabilities, 10 versions
- [Arm Compiler for Embedded](https://www.precursorintelligence.com/product/arm/arm_compiler_for_embedded): 0 vulnerabilities, 5 versions
- [Trusted Firmware M Firmware](https://www.precursorintelligence.com/product/arm/trusted_firmware_m_firmware): 0 vulnerabilities, 1 version
- [Valhall GPU Userspace Driver](https://www.precursorintelligence.com/product/arm/valhall_gpu_userspace_driver): 0 vulnerabilities, 7 versions
- [Valhall](https://www.precursorintelligence.com/product/arm/valhall): 0 vulnerabilities, 8 versions
- [Midguard](https://www.precursorintelligence.com/product/arm/midguard): 0 vulnerabilities, 4 versions
- [Midgard](https://www.precursorintelligence.com/product/arm/midgard): 0 vulnerabilities, 8 versions

## Questions

### How many vulnerabilities does Arm have?

Our catalogue lists 155 published vulnerabilities across 130 products and 674 versions from Arm. The most recent Arm flaw added to the known-exploited list is CVE-2024-4610, on 12 June 2024.

### Which Arm vulnerabilities are being exploited?

9 Arm vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2024-4610, CVE-2023-4211 and CVE-2021-29256. The full list is on this page.

### Which Arm product has the most vulnerabilities?

Mbed TLS, with 58 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Arm vulnerabilities?

Create a Precursor Intelligence account and track the Arm products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Arm?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact