CVE-2023-26083

LowCVSS 3.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
https://www.cybersecurity-help.cz/vdb/SB2023033049Third Party Advisory
https://www.cybersecurity-help.cz/vulnerabilities/74210/Third Party Advisory
https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20VulnerabilitiesVendor Advisory
https://www.cybersecurity-help.cz/vdb/SB2023033049Third Party Advisory
https://www.cybersecurity-help.cz/vulnerabilities/74210/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26083US Government Resource

Timeline

Published: Apr 6, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 7, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-260843.7The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data CVE-2023-260857.8A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before CVE-2023-260887.8In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system CVE-2023-260899.8European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. Th CVE-2023-26095.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.CVE-2023-260916.1The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.CVE-2023-260929.8Liima before 1.17.28 allows server-side template injection.CVE-2023-260939.8Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.CVE-2023-260957.5ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.CVE-2023-260975.5An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be block CVE-2023-260987.8An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arb CVE-2023-260997.1An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure.