How many CVEs does Arm have?

Arm has 170 published CVE records since 2017, including 34 in the last two years.

How many Arm CVEs are in CISA KEV?

Yes — 9 of Arm's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Arm products have the most CVEs?

The Arm products with the most published CVEs are mbed TLS, Valhall GPU Kernel Driver, Bifrost GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver, 5th_gen_gpu_architecture_kernel_driver.

What are the most common weakness types in Arm CVEs?

Arm's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), CWE-190 (Integer Overflow or Wraparound).

Are there public exploits for Arm vulnerabilities?

Yes — 26 of Arm's CVEs have a known public exploit.

How many critical Arm vulnerabilities are there?

Arm has 27 critical and 71 high-severity CVEs.

What is the average severity of Arm CVEs?

The average CVSS base score across Arm's scored CVEs is 7.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

170 CVEs

9 in CISA KEV

Arm Vulnerabilities

Name: Arm vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Arm.

170

Total CVEs

Published

9

In CISA KEV

Exploited in the wild

26

Public exploits

PoC or exploit code

7.0

Avg CVSS

2017–2026

Overview

Arm has 170 published CVE records since 2017, of which 9 are in CISA's Known Exploited Vulnerabilities catalog and 26 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Arm products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Arm's vulnerability posture, as a share of its 170 published CVEs.

Average CVSS: 7.0
Critical / high: 58%
Actively exploited (KEV): 5%
Public exploit available: 15%
Patch available: 78%

Severity and exploitation

How the CVSS severity of Arm's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical27

High71

Medium66

Low6

In CISA’s Known Exploited Vulnerabilities catalog

9

9 of Arm's CVEs are confirmed exploited in the wild.

Public exploits

26

26 of Arm's CVEs have a known public exploit available.

Most affected products

The Arm products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Arm CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Arm CVE records.

Disclosure activity by year

How many Arm CVEs were published each year.

2019

2

2020

12

2021

21

2022

22

2023

27

2024

31

2025

26

2026

8

Latest Arm CVEs

The most recently disclosed vulnerabilities affecting Arm.

Critical vulnerability · 2026-06-09
CWE-362
Critical · CVSS 9.1
EPSS 0.5%2026-06-09
Critical vulnerability · 2026-04-02
CWE-502
Critical · CVSS 9.8
EPSS 0.4%2026-04-02
Medium vulnerability · 2026-04-01
CWE-338
Medium · CVSS 6.7
EPSS 0.2%2026-04-01
Medium vulnerability · 2026-04-01
CWE-385
Medium · CVSS 5.1
EPSS 0.3%2026-04-01
High vulnerability · 2026-04-01
CWE-335
High · CVSS 7.7
EPSS 0.2%2026-04-01
Critical vulnerability · 2026-04-01
CWE-347
Critical · CVSS 9.1
EPSS 0.2%2026-04-01
Low vulnerability · 2026-03-02
CWE-362
Low · CVSS 3.6
EPSS 0.1%2026-03-02
High vulnerability · 2026-01-14
CWE-226
High · CVSS 7.9
EPSS 0.2%2026-01-14
Mali GPU Kernel Driver allows improper GPU memory processing operations
CWE-416
Medium · CVSS 5.1
EPSS 0.2%2025-12-01
Mali GPU Kernel Driver allows improper GPU processing operations
CWE-416
Medium · CVSS 4.0
EPSS 0.2%2025-12-01
Mali GPU Kernel Driver allows improper GPU processing operations
CWE-200
Medium · CVSS 5.1
EPSS 0.1%2025-12-01
Medium vulnerability · 2025-10-21
CWE-208
Medium · CVSS 5.3
EPSS 0.2%2025-10-21

Track new Arm CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Arm CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Spring172 CVEs Esri172 CVEs Frappe172 CVEs janobe172 CVEs Cacti171 CVEs Cloud Foundry171 CVEs OTRS170 CVEs MongoDB168 CVEs

Browse all vendors

Frequently asked questions

Common questions about Arm vulnerabilities.

How many CVEs does Arm have?: Arm has 170 published CVE records since 2017, including 34 in the last two years.
How many Arm CVEs are in CISA KEV?: Yes — 9 of Arm's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Arm products have the most CVEs?: The Arm products with the most published CVEs are mbed TLS, Valhall GPU Kernel Driver, Bifrost GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver, 5th_gen_gpu_architecture_kernel_driver.
What are the most common weakness types in Arm CVEs?: Arm's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), CWE-190 (Integer Overflow or Wraparound).
Are there public exploits for Arm vulnerabilities?: Yes — 26 of Arm's CVEs have a known public exploit.
How many critical Arm vulnerabilities are there?: Arm has 27 critical and 71 high-severity CVEs.
What is the average severity of Arm CVEs?: The average CVSS base score across Arm's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Arm vulnerabilities

Monitor new Arm vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing