How severe is CVE-2023-28147?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2023-28147 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Arm Avalon GPU Kernel Driver

CVE-2023-28147

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0.

Published 2023-06-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (6.9th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Public proof-of-concept exploits

1337eng/arm_

References

developer.arm.com/Arm Security Center/Mali GPU Driver Vulnerabilities (Vendor Advisory)

Frequently asked questions

What is CVE-2023-28147?: CVE-2023-28147 is a medium-severity vulnerability in Arm Avalon GPU Kernel Driver. CVSS score: 5.5/10. Published 2023-06-02.
How severe is CVE-2023-28147?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2023-28147 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.