Mesa WebGPU Bug Allows Out-of-Bounds Memory Access

A critical vulnerability, tracked as CVE-2026-40393, has been identified in Mesa, specifically impacting versions prior to 25.3.6 and 26.0.1. According to the National Vulnerability Database, this flaw stems from an out-of-bounds memory access vulnerability within the WebGPU component. The core issue lies in how Mesa allocates data: the amount of memory to be reserved depends on untrusted input, which is then used in conjunction with alloca.

This vulnerability carries a high CVSS score of 8.1, underscoring its potential severity. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that it’s network-exploitable, requires high attack complexity, and can lead to high impacts on confidentiality, integrity, and availability. Essentially, an attacker could potentially manipulate the untrusted input to trigger an out-of-bounds write, leading to arbitrary code execution or a denial-of-service condition. This is a classic CWE-787, a common vulnerability type that can have devastating consequences if exploited.