PT-2026-32182 · Mesa · Mesa

Published 2026-04-12 · Updated 2026-05-08 · CVE-2026-40393

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mesa versions prior to 25.3.6 and versions prior to 26.0.1

Description An out-of-bounds memory access issue exists in the WebGPU component of Mesa. The amount of data to be allocated is determined by an untrusted source and then used in the alloca function, potentially leading to a memory access error.

Recommendations Update Mesa to version 25.3.6 or later. Update Mesa to version 26.0.1 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-40393

ECHO-970D-B2F9-098E

OESA-2026-2048

OESA-2026-2049

OESA-2026-2050

OESA-2026-2051

OESA-2026-2052

SUSE-SU-2026:1343-1

Affected Products

Mesa

References · 29

• https://nvd.nist.gov/vuln/detail/CVE-2026-40393 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2050 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40393 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-40393 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2049 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40393 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40393 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1343-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2052 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2048 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40393 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-40393 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2051 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40393 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2052 · Note