VYPR
← All advisories
High severity8.1NVD Advisory· Published Apr 12, 2026· Updated Apr 16, 2026

CVE-2026-40393

CVE-2026-40393

Description

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Affected products

2
  • Mesa3d/Mesa2 versions
    cpe:2.3:a:mesa3d:mesa:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mesa3d:mesa:*:*:*:*:*:*:*:*range: <25.3.6
    • cpe:2.3:a:mesa3d:mesa:26.0.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.