CVE-2026-40393
Out-of-Bounds Memory Access in Mesa WebGPU Causes Potential Crash
Publication date: 2026-04-12
Last updated on: 2026-04-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mesa3d | mesa | to 25.3.6 (exc) |
| mesa3d | mesa | 26.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40393 is a vulnerability in the Mesa graphics library, specifically in the WebGPU component before versions 25.3.6 and 26.0.1. The issue arises because the amount of memory to be allocated depends on input from an untrusted party, which can lead to out-of-bounds memory access when that size is used with alloca.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access, which may allow an attacker to read or write memory outside the intended bounds. According to the CVSS score of 8.1, it has a high impact on confidentiality, integrity, and availability, meaning it could potentially allow remote attackers to execute arbitrary code, cause crashes, or leak sensitive information without requiring user interaction.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-40393, users should promptly update their Mesa installations to version 25.3.6 or 26.0.1, where the out-of-bounds memory access vulnerability in the WebGPU component has been fixed.
These updates prevent the vulnerability by addressing the unsafe memory allocation issue and include other important fixes and improvements.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-40393 affects compliance with common standards and regulations such as GDPR or HIPAA.