What is CVE-2022-36449?

CVE-2022-36449 is a medium-severity vulnerability in Arm Bifrost GPU Kernel Driver, classified under Use After Free. CVSS score: 6.5/10. Published 2022-09-01.

How severe is CVE-2022-36449?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-36449 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Use After Free in Arm Bifrost GPU Kernel Driver

CVE-2022-36449

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.

Vulnerability class: Use-After-Free

Published 2022-09-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.012 (66.4th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: -0.000

Affected products

Arm Bifrost GPU Kernel Driver — versions r39p0
Arm Midgard GPU Kernel Driver
Arm Valhall GPU Kernel Driver — versions r39p0

Weakness classification (CWE)

CWE-416 — Use After Free

Public proof-of-concept exploits

References

developer.arm.com/Arm Security Center/Mali GPU Driver Vulnerabilities (Vendor Advisory)
packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.html (VDB Entry, Third Party Advisory)
packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.ht… (VDB Entry, Third Party Advisory)
packetstormsecurity.com/files/168434/Arm-Mali-CSF-Missing-Buffer-Size-Check.html (VDB Entry, Third Party Advisory)
packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.html (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2022-36449?: CVE-2022-36449 is a medium-severity vulnerability in Arm Bifrost GPU Kernel Driver, classified under Use After Free. CVSS score: 6.5/10. Published 2022-09-01.
How severe is CVE-2022-36449?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-36449 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.