Use-after-free in ARM products - CVE-2025-0932

Vulnerability identifier: #VU113635

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-0932

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Arm Mali GPU Userspace Driver. A local application can execute arbitrary code with elevated privileges. 

Bifrost GPU Userspace Driver
Valhall GPU Userspace Driver
Arm 5th Gen GPU Architecture Userspace Driver
Google Android
Chrome OS

Install updates from vendor's website.

Bifrost GPU Userspace Driver - addressed in versions r49p4, r54p1
Valhall GPU Userspace Driver - addressed in versions r49p4, r54p1
Arm 5th Gen GPU Architecture Userspace Driver - addressed in versions r49p4, r54p1
Google Android - addressed in versions 13 2025-08-05, 14 2025-08-05, 15 2025-08-05, 16 2025-08-05
Chrome OS - addressed in versions 139.0.7258.137, 140.0.7339.201, 145.0.7632.154

• https://developer.arm.com/documentation/110626/latest/

• Privilege escalation in Arm Mali GPU Userspace Driver
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Google ChromeOS
• Multiple vulnerabilities in Google ChromeOS
• Multiple vulnerabilities in Google ChromeOS