CVE-2026-40393
Received Received - Intake
Out-of-Bounds Memory Access in Mesa WebGPU Causes Potential Crash

Publication date: 2026-04-12

Last updated on: 2026-04-16

Assigner: MITRE

Description
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-12
Last Modified
2026-04-16
Generated
2026-06-16
AI Q&A
2026-04-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-40393
EUVD
EUVD-2026-21737
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
mesa3d mesa to 25.3.6 (exc)
mesa3d mesa 26.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-40393 is a vulnerability in the Mesa graphics library, specifically in the WebGPU component before versions 25.3.6 and 26.0.1. The issue arises because the amount of memory to be allocated depends on input from an untrusted party, which can lead to out-of-bounds memory access when that size is used with alloca.

Impact Analysis

This vulnerability can lead to out-of-bounds memory access, which may allow an attacker to read or write memory outside the intended bounds. According to the CVSS score of 8.1, it has a high impact on confidentiality, integrity, and availability, meaning it could potentially allow remote attackers to execute arbitrary code, cause crashes, or leak sensitive information without requiring user interaction.

Mitigation Strategies

To mitigate CVE-2026-40393, users should promptly update their Mesa installations to version 25.3.6 or 26.0.1, where the out-of-bounds memory access vulnerability in the WebGPU component has been fixed.

These updates prevent the vulnerability by addressing the unsafe memory allocation issue and include other important fixes and improvements.

Compliance Impact

The provided information does not specify how CVE-2026-40393 affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart