CVE-2026-40393
Published: 12 April 2026
Summary
CVE-2026-40393 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Mesa3D Mesa. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-40393 is an out-of-bounds memory access vulnerability (CWE-787) in the WebGPU implementation of Mesa, affecting versions before 25.3.6 and 26 before 26.0.1. The flaw occurs because the amount of data to be allocated depends on input from an untrusted party, which is then used directly in an alloca operation, potentially leading to memory corruption. Published on 2026-04-12, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by unauthenticated attackers over the network, requiring no user interaction but high attack complexity. Successful exploitation enables high-impact consequences, including unauthorized disclosure of sensitive information, modification of data or system integrity, and denial of service through system crashes or corruption.
Mitigation details are available in the referenced advisories: a Mesa merge request at https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866 and a mesa-dev mailing list announcement at https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html. Updating to Mesa 25.3.6, 26.0.1, or later versions addresses the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21737
Vulnerability details
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote memory corruption (out-of-bounds access via untrusted alloca size) in client-side graphics library (Mesa WebGPU) directly enables arbitrary code execution on affected client applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and correcting the specific out-of-bounds memory access flaw through timely patching to Mesa 25.3.6 or later.
Implements memory protection mechanisms that enforce boundaries to prevent out-of-bounds access and memory corruption from untrusted allocation sizes in WebGPU.
Requires validation of untrusted inputs, such as allocation sizes from external parties, to prevent their direct use in alloca operations leading to OOB access.