# Arm vulnerabilities

Source: https://junglewise.ai/threats/vendors/arm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 10 November 2026, 21:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/arm.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 34 vulnerabilities in Arm: 1 in the last 7 days and 14 in the last 90 days, 11 of them critical and 9 exploited in the wild. The most recent, CVE-2026-59580, was published on 10 November 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2). 6 technologies have a page of their own.

## Counts

- Last 7 days: 1
- Last 30 days: 4
- Last 90 days: 14
- All time: 34 (11 critical, 9 exploited in the wild)

## About Arm

A semiconductor and software design company that develops processor architectures and intellectual property.

## Latest Arm vulnerabilities

- [CVE-2026-59580: ARM Trusted Firmware Secure world register state leak in Trusty context switch](https://junglewise.ai/threats/cve-2026-59580-in-trusty-context-switch-of-services-spd-trusty-trusty-c-there-is) (info, published 10 Nov 2026)
- [CVE-2026-115680: Arm Keil MDK-Middleware DHCPv6 option over-read and data retransmission](https://junglewise.ai/threats/cve-2026-115680-arm-keil-mdk-middleware-8-0-0-8-3-0-may-allow-dhcpv6-option-walk) (info, published 26 Oct 2026)
- [CVE-2026-115679: Arm Keil MDK-Middleware FTP Server out-of-bounds buffer access](https://junglewise.ai/threats/cve-2026-115679-arm-keil-mdk-middleware-8-3-0-may-allow-out-of-bounds-reads-and) (info, published 26 Oct 2026)
- [CVE-2026-115678: Arm Keil MDK-Middleware out-of-bounds read in SNMP processing](https://junglewise.ai/threats/cve-2026-115678-arm-keil-mdk-middleware-8-0-0-8-3-0-may-allow-pre-authentication) (info, published 26 Oct 2026)
- [CVE-2026-102709: Arm TrustZone-M pointer validation bypass in NSC entry functions](https://junglewise.ai/threats/cve-2026-102709-improper-validation-of-non-secure-ns-pointers-in-multiple) (info, published 29 Sep 2026)
- [CVE-2026-58766: ARM SMMU-v3 privilege escalation due to logic error](https://junglewise.ai/threats/cve-2026-58766-arm-smmu-v3-privilege-escalation-due-to-logic-error) (high, CVSS 7.8, published 15 Sep 2026)
- [CVE-2026-9040: Arm Bifrost, Valhall, and 5th Gen GPU Kernel Driver race condition](https://junglewise.ai/threats/cve-2026-9040-arm-bifrost-valhall-and-5th-gen-gpu-kernel-driver-race-condition) (high, CVSS 7.7, published 8 Sep 2026)
- [CVE-2026-9034: Arm Bifrost GPU Userspace Driver use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-9034-arm-bifrost-gpu-userspace-driver-use-after-free-vulnerability) (high, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-7476: Arm Bifrost GPU Kernel Driver use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-7476-arm-bifrost-gpu-kernel-driver-use-after-free-vulnerability) (high, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-5729: Arm Valhall GPU Kernel Driver use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-5729-arm-valhall-gpu-kernel-driver-use-after-free-vulnerability) (high, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-12285: Arm Bifrost/Valhall GPU Kernel Driver use-after-free](https://junglewise.ai/threats/cve-2026-12285-arm-bifrost-valhall-gpu-kernel-driver-use-after-free) (medium, CVSS 4, published 8 Sep 2026)
- [CVE-2026-11891: Arm Valhall GPU Userspace Driver use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-11891-arm-valhall-gpu-userspace-driver-use-after-free-vulnerability) (medium, CVSS 5.1, published 8 Sep 2026)
- [CVE-2026-0860: Arm Valhall GPU Kernel Driver information disclosure](https://junglewise.ai/threats/cve-2026-0860-arm-valhall-gpu-kernel-driver-information-disclosure) (high, CVSS 7.5, published 8 Sep 2026)
- [CVE-2026-0001: Arm GPU Kernel Driver use-after-free in memory processing](https://junglewise.ai/threats/cve-2026-0001-arm-gpu-kernel-driver-use-after-free-in-memory-processing) (medium, CVSS 4.4, published 8 Sep 2026)
- [CVE-2025-10263: Arm Multiple CPU Cores privilege escalation via unauthorized writes](https://junglewise.ai/threats/cve-2025-10263-arm-multiple-cpu-cores-privilege-escalation-via-unauthorized) (high, published 9 Jun 2026)
- [CVE-2026-42627: Arm ArmNN integer overflow in TensorShape::GetNumElements](https://junglewise.ai/threats/cve-2026-42627-arm-armnn-integer-overflow-in-tensorshape-getnumelements) (medium, CVSS 6.2, published 22 May 2026)
- [CVE-2026-34877: Mbed TLS memory corruption via insecure deserialization of SSL context](https://junglewise.ai/threats/cve-2026-34877-mbed-tls-memory-corruption-via-insecure-deserialization-of-ssl) (critical, CVSS 9.8, published 2 Apr 2026)
- [CVE-2026-34873: Mbed TLS client impersonation in TLS 1.3 session resumption](https://junglewise.ai/threats/cve-2026-34873-mbed-tls-client-impersonation-in-tls-1-3-session-resumption) (critical, CVSS 9.1, published 1 Apr 2026)
- [CVE-2025-66442: In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only…](https://junglewise.ai/threats/cve-2025-66442-in-mbed-tls-through-4-0-0-there-is-a-compiler-induced-timing-side) (medium, CVSS 5.1, published 1 Apr 2026)
- [CVE-2026-34871: Arm Mbed TLS Predictable Seed in PRNG on Linux](https://junglewise.ai/threats/cve-2026-34871-arm-mbed-tls-predictable-seed-in-prng-on-linux) (medium, CVSS 6.7, published 1 Apr 2026)
- [CVE-2026-25835: Arm Mbed TLS and TF-PSA-Crypto PRNG state cloning vulnerability](https://junglewise.ai/threats/cve-2026-25835-arm-mbed-tls-and-tf-psa-crypto-prng-state-cloning-vulnerability) (high, CVSS 7.7, published 1 Apr 2026)
- [CVE-2025-8045: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver…](https://junglewise.ai/threats/cve-2025-8045-use-after-free-vulnerability-in-arm-ltd-valhall-gpu-kernel-driver) (medium, CVSS 4, published 1 Dec 2025)
- [CVE-2025-6349: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver…](https://junglewise.ai/threats/cve-2025-6349-use-after-free-vulnerability-in-arm-ltd-valhall-gpu-kernel-driver) (medium, CVSS 5.1, published 1 Dec 2025)
- [CVE-2025-2879: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd…](https://junglewise.ai/threats/cve-2025-2879-exposure-of-sensitive-information-to-an-unauthorized-actor) (medium, CVSS 5.1, published 1 Dec 2025)
- [CVE-2025-49601: Mbed TLS out-of-bounds read in mbedtls_lms_import_public_key](https://junglewise.ai/threats/cve-2025-49601-mbed-tls-out-of-bounds-read-in-mbedtls-lms-import-public-key) (medium, CVSS 4.8, published 4 Jul 2025)

## Most severe Arm vulnerabilities

- [CVE-2021-29256: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2021-29256-arm-mali-gpu-kernel-driver-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 7 Jul 2023)
- [CVE-2022-38181: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-38181-arm-mali-gpu-kernel-driver-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 30 Mar 2023)
- [CVE-2021-28663: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2021-28663-arm-mali-graphics-processing-unit-gpu-use-after-free) (critical, exploited in the wild, CVSS 8.8, published 3 Nov 2021)
- [CVE-2021-28664: Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability](https://junglewise.ai/threats/cve-2021-28664-arm-mali-graphics-processing-unit-gpu-unspecified-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Nov 2021)
- [CVE-2024-4610: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2024-4610-arm-mali-gpu-kernel-driver-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 12 Jun 2024)
- [CVE-2022-22706: Arm Mali GPU Kernel Driver Unspecified Vulnerability](https://junglewise.ai/threats/cve-2022-22706-arm-mali-gpu-kernel-driver-unspecified-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 30 Mar 2023)
- [CVE-2023-4211: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2023-4211-arm-mali-gpu-kernel-driver-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 5.5, published 3 Oct 2023)
- [CVE-2021-27562: Arm Trusted Firmware Out-of-Bounds Write Vulnerability](https://junglewise.ai/threats/cve-2021-27562-arm-trusted-firmware-out-of-bounds-write-vulnerability) (critical, exploited in the wild, CVSS 5.5, published 3 Nov 2021)
- [CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2023-26083-arm-mali-gpu-kernel-driver-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 3.3, published 7 Apr 2023)
- [CVE-2026-34877: Mbed TLS memory corruption via insecure deserialization of SSL context](https://junglewise.ai/threats/cve-2026-34877-mbed-tls-memory-corruption-via-insecure-deserialization-of-ssl) (critical, CVSS 9.8, published 2 Apr 2026)

## Vulnerabilities per week

3 vulnerabilities in the last four weeks, up 50% on the four before (2).

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 8 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 1 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 3 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 1 | 0 | 0 |

## Arm technologies

- [Arm Mbed TLS](https://junglewise.ai/threats/technologies/mbed-tls): 14 vulnerabilities
- [Arm 5th Gen GPU Architecture Kernel Driver](https://junglewise.ai/threats/technologies/5th-gen-gpu-architecture-kernel-driver): 11 vulnerabilities
- [Arm Valhall GPU Kernel Driver](https://junglewise.ai/threats/technologies/valhall-gpu-kernel-driver): 11 vulnerabilities
- [Arm Bifrost GPU Kernel Driver](https://junglewise.ai/threats/technologies/bifrost-gpu-kernel-driver): 6 vulnerabilities
- [Arm Mali Graphics Processing Unit (GPU)](https://junglewise.ai/threats/technologies/mali-graphics-processing-unit-gpu): 6 vulnerabilities
- [Arm Keil MDK-Middleware](https://junglewise.ai/threats/technologies/keil-mdk-middleware): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Arm vulnerabilities", https://junglewise.ai/threats/vendors/arm, 10 November 2026.