PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-28664 Arm CVE debrief

CVE-2021-28664 is a CISA Known Exploited Vulnerability affecting Arm Mali Graphics Processing Unit (GPU) products. CISA added it to the KEV catalog on 2021-11-03 and set a remediation due date of 2021-11-17, so affected fleets should be patched per vendor guidance as a priority.

Vendor
Arm
Product
Mali Graphics Processing Unit (GPU)
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Organizations that deploy or manage devices, firmware, or software components using Arm Mali Graphics Processing Unit (GPU) technology should care, especially OEMs, embedded-device operators, mobile-device managers, and teams responsible for patching graphics stack dependencies.

Technical summary

The supplied corpus identifies CVE-2021-28664 as an Arm Mali Graphics Processing Unit (GPU) unspecified vulnerability. The public source set does not include a root cause, impact details, affected version range, or CVSS score. The most actionable fact in the corpus is CISA’s KEV listing, which indicates the issue is treated as a known-exploited priority for remediation.

Defensive priority

High. Because the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, remediation should be prioritized for any affected Arm Mali GPU deployments.

Recommended defensive actions

  • Apply vendor updates per Arm instructions as soon as possible.
  • Inventory products and firmware that include Arm Mali Graphics Processing Unit (GPU) components.
  • Prioritize remediation on exposed, user-facing, and hard-to-replace devices first.
  • Validate that remediation is complete by confirming the vendor version or fix status on all affected assets.
  • Track CISA KEV and vendor advisories for any follow-up guidance or related fixes.

Evidence notes

This debrief is based only on the provided official sources and metadata: CISA KEV, the CVE record, and the NVD detail page. The corpus confirms the CVE identifier, Arm Mali GPU product association, KEV inclusion, and dates (published/added on 2021-11-03; due date 2021-11-17). It does not provide technical exploit details, affected versions, or a CVSS score, so no additional impact claims are made.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-28664 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-28664

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-28664 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-28664

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.