CVE Intelligence
Analysis AI-assisted

CVE-2026-40393: Mesa WebGPU out-of-bounds memory access

CVE-2026-40393 affects Mesa WebGPU, where out-of-bounds memory access can occur because the amount of data to allocate depends on an untrusted party and is then used for alloca. The record lists Mesa versions before 25.3.6 and versions before 26.0.1 as affected, with NVD scoring it 9.8 and the CNA scoring it 8.1. No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Mesa is an open-source graphics library. This CVE describes an out-of-bounds memory access in its WebGPU implementation. According to the record, the amount of memory to be allocated depends on data from an untrusted party and is then used for alloca.

Impact

  • The record classifies the weakness as CWE-787, Out-of-bounds Write.
  • NVD assigns a CVSS score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA (MITRE) lists a score of 8.1 for the same CVE.
  • The SSVC data in the record shows exploitation as none, automatable as no, and technical impact as total.

Affected products and versions

  • Product: Mesa3d Mesa.
  • The record lists versions before 25.3.6, version 26.0.0, and versions from 26.0.0 up to but not including 26.0.1.
  • The description states that Mesa versions before 25.3.6 and versions before 26.0.1 in the affected release line are impacted.

Exploitation status

  • The CISA KEV data in the record shows the CVE is not listed.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability is 0.00615 with a percentile of 0.48812 in the record snapshot.

Remediation and mitigation

  • Inventory Mesa installations and check whether they fall within the affected ranges.
  • Plan an upgrade to a Mesa release that is newer than the affected ranges, following the vendor or distribution guidance. The record does not list explicit fixed versions, so confirm the correct release in the referenced sources.
  • Review the Debian LTS announcement listed in the references for distribution-specific update information.
  • If upgrading is delayed, limit exposure of WebGPU workloads to untrusted content, as a defensive measure.

Detection guidance

  • Monitor for crashes or unexpected terminations in applications that use Mesa WebGPU.
  • Use software inventory tools to identify Mesa packages and their installed versions.
  • Track vendor advisories and distribution security notices for updates.

Limitations of the available information

  • The record contains no explicit fixed versions, and its fixes list is empty.
  • The CVSS scores differ between NVD (9.8) and the CNA (8.1).
  • The record has no title, so the title was derived from the description.
  • The record does not describe the vulnerable code path in detail, and this analysis does not add that detail.

Frequently asked questions

Which Mesa versions are affected by CVE-2026-40393?

The record lists Mesa versions before 25.3.6, version 26.0.0, and versions from 26.0.0 up to but not including 26.0.1 as affected. Check your installed version against these ranges.

Is CVE-2026-40393 being exploited in the wild?

The CISA KEV data in the record shows the CVE is not listed, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.