CVE-2025-10263: arm c1-premium_firmware
Vulnerability summary
CVE-2025-10263 is a critical (CVSS 9.1) vulnerability in arm c1-premium_firmware. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 55 · Related 43Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 04-09-2026Last modifiedVulnerability information updated.
Description
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.54% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu168 products
- linuxAll versions (No fix recorded) | < 5.15.0-194.204 | < 6.8.0-142.142 | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1116.123 | < 6.8.0-1065.68 | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Arm20 products
- c1-premium_firmwareAll versions (No fix recorded)
- c1-ultra_firmwareAll versions (No fix recorded)
- cortex-a710_firmwareAll versions (No fix recorded)
- cortex-a76_firmwareAll versions (No fix recorded)
- cortex-a76ae_firmwareAll versions (No fix recorded)
Debian3 products
- arm-trusted-firmwareAll versions (No fix recorded) | < 2.12.16+dfsg-1
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.13-1
- xen< 4.17.7-0+deb12u1 | < 4.20.3+127-gc42374a105-0+deb13u1 | < 4.20.3+127-gc42374a105-1
Alpine1 product
- xen< 4.18.5-r9 | < 4.19.5-r4 | < 4.20.3-r4 | < 4.21.1-r6
4 vendors · 192 products
