CVE-2021-28663VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-28663: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

Affects Arm Mali Graphics Processing Unit (GPU)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 12.1% chance of exploitation in 30 days – higher than 96% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-28663 (opens in a new tab)

Description

CVE-2021-28663 is a use-after-free vulnerability in the Arm Mali Graphics Processing Unit (GPU) kernel driver. This flaw allows a non-privileged user to perform improper operations on GPU memory, potentially leading to privilege escalation to root or information disclosure. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The Arm Mali GPU kernel driver contains a use-after-free vulnerability (CWE-416) that can be triggered by a non-privileged user. Exploiting this vulnerability may allow the attacker to gain root privileges or disclose sensitive information by manipulating GPU memory improperly. The vulnerability has been observed in active exploitation scenarios. No vendor advisory or patch details are included in the provided information.

Impact

Successful exploitation can result in privilege escalation to root and/or unauthorized disclosure of information. This elevates the risk of full system compromise on affected devices using the vulnerable Arm Mali GPU driver. The vulnerability is known to be exploited in the wild, increasing its threat level.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict untrusted users' access to systems with the vulnerable Arm Mali GPU driver to reduce exploitation risk.

Weaknesses

CWE-416Use After Free (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:40:32 UTC

Weaknesses

References

Related threats