CVE-2025-0932
Last modified
CVE-2025-0932 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arm | 5th Gen Gpu Architecture Userspace Driver | >= r48p0, < r49p4 |
| Arm | 5th Gen Gpu Architecture Userspace Driver | >= r50p0, < r54p1 |
| Arm | Bifrost Gpu Userspace Driver | >= r48p0, < r49p4 |
| Arm | Bifrost Gpu Userspace Driver | >= r50p0, < r54p1 |
| Arm | Valhall Gpu Userspace Driver | >= r48p0, < r49p4 |
| Arm | Valhall Gpu Userspace Driver | >= r50p0, < r54p1 |
References
- https://developer.arm.com/documentation/110626/latest/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-0932?
How severe is CVE-2025-0932?
How do I fix CVE-2025-0932?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0925Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2025-0926Gee-netics, member of AXIS Camera Station Pro Bug Bounty Pro…7.3
- CVE-2025-0927Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-0928In Juju versions prior to 3.6.8 and 2.9.52, any authenticate…8.8
- CVE-2025-0929SQL injection vulnerability in TeamCal Neo, version 3.8.2. T…9.8
- CVE-2025-0930Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version…6.1
- CVE-2025-0934A vulnerability was found in code-projects Job Recruitment 1…7.5
- CVE-2025-0935The Media Library Folders plugin for WordPress is vulnerable…4.3
- CVE-2025-0936On affected platforms running Arista EOS with a gNMI transpo…6.5
- CVE-2025-0937Nomad Community and Nomad Enterprise ("Nomad") event stream …7.1
- CVE-2025-0938The Python standard library functions `urllib.parse.urlsplit…6.3
- CVE-2025-0939The MagicForm plugin for WordPress is vulnerable to access a…6.3
Are you affected by CVE-2025-0932?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST