High severity8.1NVD Advisory· Published Apr 12, 2026· Updated Apr 16, 2026

CVE-2026-40393

Description

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mesa3d/Mesa3 versions
cpe:2.3:a:mesa3d:mesa:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mesa3d:mesa:*:*:*:*:*:*:*:*range: <25.3.6
- cpe:2.3:a:mesa3d:mesa:26.0.0:*:*:*:*:*:*:*
- (no CPE)range: <25.3.6, <26.0.1
osv-coords
pkg:rpm/suse/Mesa&distro=SUSE%20Linux%20Enterprise%20Micro%205.2
Range: < 20.2.4-150300.59.12.1

Patches

Vulnerability mechanics

References

gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866nvdIssue Tracking
lists.freedesktop.org/archives/mesa-dev/2026-February/226597.htmlnvdIssue TrackingMailing List

News mentions

Patch Tuesday - April 2026
Rapid7 Blog · Apr 14, 2026

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000