CVE-2025-10263 Privilege escalation in C1-Premium

Critical 9.1 Published 9 Jun 2026 Updated 4 Sep 2026

Attackers can write to higher exception level resources on specific Arm CPU cores, enabling privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-10263?

CVE-2025-10263 is a critical vulnerability in Arm C1-Premium, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

Weakness: CWE-266, CWE-362

Which versions are affected by CVE-2025-10263?

How do I fix CVE-2025-10263?

Apply the vendor's patch.

Is CVE-2025-10263 being exploited?

There is no known exploitation of CVE-2025-10263 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as ALPINE-CVE-2025-10263, DEBIAN-CVE-2025-10263, GHSA-x9c8-763w-495x, ROOT-OS-DEBIAN-11-CVE-2025-10263, ROOT-OS-DEBIAN-12-CVE-2025-10263, UBUNTU-CVE-2025-10263.