CVE-2021-28663 is an use-after-free vulnerability in Arm Mali Graphics Processing Unit (GPU). CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What the vulnerability is and why use-after-free matters in a GPU
A use-after-free in a graphics driver means the driver may keep using memory after it has been released. In a GPU component, that can turn an ordinary rendering bug into a serious kernel or device-level security issue because the driver sits close to privileged system resources.
The danger is not just a crash. Memory corruption in graphics stacks can sometimes be shaped into code execution, information disclosure, or a stable foothold inside the graphics subsystem, which is why use-after-free flaws are treated as high-priority security defects even when the visible symptom looks like a performance or stability problem.
How organisations assess exposure
For a named CVE like this, exposure assessment starts with asset inventory: which devices use Arm Mali GPUs, which operating systems ship the affected driver stack, and which endpoints actually load the vulnerable component. A vendor advisory is the most reliable source for version-specific applicability, while the NIST National Vulnerability Database and the CVE Program help confirm the identifier and record context.
Organisations should also check whether the affected devices are internet-exposed, used for high-trust workloads, or embedded in products that are difficult to patch quickly. Because graphics drivers are often bundled into firmware, mobile builds, or vendor-specific images, the practical exposure question is usually broader than a single application inventory entry.
Remediation, mitigation, and compensating controls
The primary response is to apply the vendor fix or approved mitigation as soon as it is available. Where patching is delayed, reduce attack surface by limiting untrusted content paths, restricting unnecessary local access, and tightening device hardening around the vulnerable platform so the flaw is harder to trigger and harder to turn into meaningful compromise.
For endpoint fleets, prioritisation should follow exploitability rather than asset age alone. A vulnerability that is already in CISA’s KEV catalogue deserves accelerated handling, because known exploitation means the question is no longer theoretical. The Vulnerability Management Guide is useful for structuring that prioritisation around asset scope, KEV status, verification, and remediation tracking.
Detection, validation, and post-patch review
Detection for a GPU use-after-free is usually indirect. Security teams look for driver crashes, anomalous graphics process behaviour, unexpected privilege boundaries being crossed, or signs that the original exploit path succeeded before the patch landed. If exploitation is suspected, validate whether the device shows persistence, injected code, tampered drivers, or other follow-on activity.
After remediation, verify that the vulnerable build is gone and that no attacker-controlled artefacts remain. If the exploit exposed credentials, sessions, signing material, or service access through the compromised host, those identity-bearing materials should be reviewed and rotated as part of the incident response process. The broader pattern of exploited software defects leading to credential theft and lateral movement is covered in The State of NHI & AI Agent Breach Report 2026.
Risk and Threat Considerations
This kind of bug is risky because graphics drivers are privileged, widely deployed, and often trusted by the operating system. Once exploited, a memory-safety flaw can become an entry point for code execution, sandbox escape, or deeper host compromise, especially on systems where driver updates lag behind vendor guidance.
Failure mechanism: The attacker triggers the use-after-free so the GPU driver dereferences or reuses freed memory, allowing corruption of driver state or controlled execution.
Impact: Successful exploitation can lead to system instability, local privilege escalation, information disclosure, or a foothold that supports broader compromise of the endpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Use-after-free flaws require rapid remediation and patch verification. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on finding affected assets and confirming their state. | |
| Recommendation — Track the vendor fix, deploy it quickly, and verify the vulnerable driver build is removed. Scan and inventory devices to confirm where the vulnerable GPU stack is installed. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Known exploited CVEs require prioritised identification and remediation across the fleet. |
| Recommendation — Prioritise KEV-listed devices for remediation and track closure until the fix is validated. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | KEV-listed exploitation changes remediation priority and risk acceptance decisions. |
| Recommendation — Escalate exploit-known driver flaws in your risk process and treat them as urgent remediation items. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | A driver use-after-free can be used to escalate privileges after initial execution. |
| Recommendation — Map exploit telemetry to privilege-escalation detection and investigate unexpected driver crashes. | ||
Practitioner Guidance
Why practitioners should care: Treat GPU driver vulnerabilities as endpoint security issues, not just graphics defects. If the vulnerable driver is present on user devices, kiosks, or high-value workstations, it can undermine the trust boundary around the entire host.
What to watch for: Prioritise exposed endpoints that combine internet-facing use, delayed patch cycles, or high-privilege local accounts. Those conditions make a memory-corruption flaw more valuable to an attacker and more likely to matter operationally.