CVE-2026-40393 Details
Description
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
A vulnerability allowing out-of-bounds memory access has been identified in Mesa versions prior to 25.3.6 and 26 prior to 26.0.1. This issue arises in the WebGPU component, where the amount of data to be allocated is determined by an untrusted source and subsequently used with the alloca function, potentially leading to memory corruption.
Users are advised to update to Mesa versions 25.3.6 or 26.0.1, both of which include the necessary security fix. The release notes for these versions are available on the Mesa GitLab repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html | CVE | |
| https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866 | [email protected] | Issue Tracking |
| https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html | [email protected] | Issue TrackingMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mesa3d mesa | < 25.3.6 26.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 12, 2026 | New CVE Received | [email protected] |