# CVE-2025-10263: Arm Multiple CPU Cores privilege escalation via unauthorized writes

Source: https://junglewise.ai/threats/cve-2025-10263-arm-multiple-cpu-cores-privilege-escalation-via-unauthorized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-10263 · Severity: high · Published 2026-06-09

A security vulnerability exists in several Arm processor families, including Neoverse and Cortex-X/A series, which are widely used in servers, mobile devices, and automotive systems. This flaw could allow a lower-privileged program to modify data or resources that should be protected by the operating system or secure firmware. If exploited, this could lead to a compromise of the system's integrity or an escalation of privileges, potentially allowing an attacker to bypass security boundaries.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2025-10263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10263 being exploited in the wild.

**How severe is CVE-2025-10263?** High severity, published 9 June 2026.

**Which products and versions are affected?** Arm C1-Ultra; Arm C1-Premium; Arm Neoverse V3 & V3AE; Arm Neoverse V2; and 12 more.

**Is there a fix for CVE-2025-10263?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-10263 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2025-10263?** Check whether you run Google Cloud Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition (CWE-362) exists in multiple Arm CPU architectures, including Neoverse and various Cortex cores. The vulnerability allows an attacker at a lower Exception Level (EL) to perform unauthorized writes to resources that are technically owned by a higher Exception Level. This suggests a failure in hardware-level synchronization or access control enforcement during concurrent execution. An attacker with local execution capabilities could potentially leverage this to escalate privileges or corrupt sensitive system state. Affected models span high-performance server cores (Neoverse) and mobile/consumer cores (Cortex-X and Cortex-A series).

## Affected products

- Arm C1-Ultra
- Arm C1-Premium
- Arm Neoverse V3 & V3AE
- Arm Neoverse V2
- Arm Neoverse V1
- Arm Neoverse-N2
- Arm Neoverse-N1
- Arm Cortex-X925
- Arm Cortex-X4
- Arm Cortex-X3
- Arm Cortex-X2
- Arm Cortex-X1 & X1C
- Arm Cortex-A710
- Arm Cortex-A78, A78AE & A78C
- Arm Cortex-A77
- Arm Cortex-A76 & A76A

## Timeline

- 2026-06-09: disclosed: Initial disclosure by Arm Limited
- 2026-06-09: advisory: NVD record published

## References

- [https://developer.arm.com/documentation/112137](https://developer.arm.com/documentation/112137)

## Related threats

- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080)
- [Slurm multiple vulnerabilities in Cluster Toolkit](https://junglewise.ai/threats/cve-2026-65107-slurm-sbcast-shared-library-validation-bypass)
- [Google Application Integration deserialization of untrusted data in SubWorkflow](https://junglewise.ai/threats/cve-2026-93327-gcp-2026-074)
- [Google Compute Engine incorrect authorization in disk access](https://junglewise.ai/threats/cve-2026-85299-gcp-2026-073)