{"id":"CVE-2026-40393","aliases":["AZL-82688","BELL-CVE-2026-40393","CLSA-2026-1787314086","DEBIAN-CVE-2026-40393","EUVD-2026-21737","GHSA-w54f-pw7x-c532","OESA-2026-2048","OESA-2026-2049","OESA-2026-2050","OESA-2026-2051","OESA-2026-2052","ROOT-OS-DEBIAN-11-CVE-2026-40393","ROOT-OS-DEBIAN-12-CVE-2026-40393","ROOT-OS-DEBIAN-13-CVE-2026-40393","SUSE-SU-2026:1343-1","SUSE-SU-2026:1835-1","SUSE-SU-2026:1839-1","SUSE-SU-2026:1844-1","SUSE-SU-2026:1845-1","SUSE-SU-2026:21292-1","SUSE-SU-2026:21412-1","SUSE-SU-2026:21534-1","SUSE-SU-2026:21564-1","UBUNTU-CVE-2026-40393","USN-8427-1","openSUSE-SU-2026:20688-1"],"status":"published","title":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU...","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00435,"percentile":0.38083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-04-12T18:49:18Z","modified":"2026-11-09T12:49:54Z","fixes":[{"ecosystem":"Azure Linux:3","package":"mesa","fixed_in":["24.0.1-8"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"mesa","fixed_in":["26.0.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libd3dadapter9-mesa","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libd3dadapter9-mesa-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl-mesa0","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl1-mesa","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl1-mesa-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgbm-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgbm1","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-dri","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-glx","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libglapi-mesa","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgles2-mesa","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgles2-mesa-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libglx-mesa0","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libosmesa6","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libosmesa6-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libwayland-egl1-mesa","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxatracker-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxatracker2","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-common-dev","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-opencl-icd","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-va-drivers","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-vdpau-drivers","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-vulkan-drivers","fixed_in":["20.0.8-0ubuntu1~18.04.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mesa","fixed_in":["22.3.6-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mesa","fixed_in":["25.0.7-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mesa","fixed_in":["26.0.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"mesa","fixed_in":["24.0.3-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"mesa","fixed_in":["24.0.3-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"mesa","fixed_in":["20.1.4-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mesa","fixed_in":["21.3.1-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"mesa","fixed_in":["24.0.3-5.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"Mesa","fixed_in":["20.2.4-150300.59.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"mesa","fixed_in":["23.2.1-1ubuntu3.1~22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"mesa","fixed_in":["25.2.8-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"mesa","fixed_in":["25.2.8-0ubuntu0.25.10.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.1-8"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r4"},{"fixed":"26.0.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libd3dadapter9-mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libd3dadapter9-mesa-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl-mesa0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl1-mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libegl1-mesa-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgbm-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgbm1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-dri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgl1-mesa-glx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglapi-mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgles2-mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgles2-mesa-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglx-mesa0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libosmesa6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libosmesa6-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libwayland-egl1-mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxatracker-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxatracker2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-common-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-opencl-icd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-va-drivers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-vdpau-drivers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"mesa-vulkan-drivers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3.6-1+deb12u2"}]}],"versions":["22.3.6-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.7-2+deb13u1"}]}],"versions":["25.0.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.1-1"}]}],"versions":["25.0.7-2","25.1.0-1","25.1.5-1","25.1.7-1","25.2.0-1","25.2.1-1","25.2.1-2","25.2.2-1","25.2.3-1","25.2.3-1~bpo13+1","25.2.4-1","25.2.4-1~bpo13+1","25.2.4-1~bpo13+2","25.2.5-1","25.2.6-1","25.2.6-1~bpo13+1","25.2.7-1","25.2.8-1","25.2.8-2","25.3.0-1","25.3.0~rc1-1","25.3.0~rc2-1","25.3.0~rc4-1","25.3.1-1","25.3.2-1","25.3.2-2","25.3.3-1","26.0.0-1","26.0.0~rc3-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.3-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.3-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.1.4-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.3-5.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"Mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-150300.59.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.2-1ubuntu4","11.0.4-1ubuntu1","11.0.5-1ubuntu1","11.0.5-1ubuntu2","11.0.6-1ubuntu1","11.0.7-1ubuntu1","11.0.8-1ubuntu1","11.1.1-1ubuntu2","11.1.2-1ubuntu1","11.1.2-1ubuntu2","11.2.0-1ubuntu1","11.2.0-1ubuntu2","11.2.0-1ubuntu2.1","11.2.0-1ubuntu2.2","12.0.6-0ubuntu0.16.04.1","17.0.7-0ubuntu0.16.04.1","17.0.7-0ubuntu0.16.04.2","17.2.4-0ubuntu1~16.04.2","17.2.4-0ubuntu1~16.04.4","17.2.8-0ubuntu0~16.04.1","18.0.5-0ubuntu0~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.2.2-0ubuntu1","17.2.4-0ubuntu2","17.3.3-0ubuntu1","18.0.0~rc4-1ubuntu3","18.0.0~rc5-1ubuntu1","18.0.5-0ubuntu0~18.04.1","18.2.2-0ubuntu1~18.04.1","18.2.2-0ubuntu1~18.04.2","18.2.8-0ubuntu0~18.04.2","19.0.2-1ubuntu1.1~18.04.1","19.0.2-1ubuntu1.1~18.04.2","19.0.8-0ubuntu0~18.04.1","19.0.8-0ubuntu0~18.04.2","19.0.8-0ubuntu0~18.04.3","19.2.1-1ubuntu1~18.04.1","19.2.8-0ubuntu0~18.04.1","19.2.8-0ubuntu0~18.04.2","19.2.8-0ubuntu0~18.04.3","20.0.8-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.2.1-1ubuntu1","19.2.4-1ubuntu1","19.3.3-1ubuntu1","20.0.0-1ubuntu1","20.0.2-1ubuntu1","20.0.4-1ubuntu1","20.0.4-2ubuntu1","20.0.8-0ubuntu1~20.04.1","20.2.6-0ubuntu0.20.04.1","21.0.3-0ubuntu0.2~20.04.1","21.0.3-0ubuntu0.3~20.04.1","21.0.3-0ubuntu0.3~20.04.2","21.0.3-0ubuntu0.3~20.04.3","21.0.3-0ubuntu0.3~20.04.4","21.0.3-0ubuntu0.3~20.04.5","21.2.6-0ubuntu0.1~20.04.1","21.2.6-0ubuntu0.1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.1-1ubuntu3.1~22.04.4"}]}],"versions":["21.2.2-1ubuntu1","21.3.5-1ubuntu1","22.0.0-0ubuntu2","22.0.1-1ubuntu1","22.0.1-1ubuntu2","22.0.1-1ubuntu2.1","22.0.5-0ubuntu0.1","22.0.5-0ubuntu0.3","22.2.5-0ubuntu0.1~22.04.1","22.2.5-0ubuntu0.1~22.04.2","22.2.5-0ubuntu0.1~22.04.3","23.0.4-0ubuntu1~22.04.1","23.2.1-1ubuntu3.1~22.04.2","23.2.1-1ubuntu3.1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2.8-0ubuntu0.24.04.2"}]}],"versions":["23.2.1-1ubuntu3","23.2.1-1ubuntu4","23.3.0-2ubuntu3","23.3.3-1ubuntu2","24.0.1-1ubuntu1","24.0.3-1ubuntu3","24.0.3-1ubuntu4","24.0.5-1ubuntu1","24.0.9-0ubuntu0.1","24.0.9-0ubuntu0.2","24.0.9-0ubuntu0.3","24.2.8-1ubuntu1~24.04.1","25.0.7-0ubuntu0.24.04.1","25.0.7-0ubuntu0.24.04.2","25.2.8-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2.8-0ubuntu0.25.10.2"}]}],"versions":["25.0.3-1ubuntu2","25.0.7-0ubuntu1","25.0.7-0ubuntu2","25.0.7-0ubuntu3","25.1.5-1ubuntu1","25.1.7-1ubuntu1","25.2.1-2ubuntu1","25.2.2-1ubuntu1","25.2.3-1ubuntu1","25.2.8-0ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.1-1ubuntu3.1~22.04.4"}]}],"versions":["21.2.2-1ubuntu1","21.3.5-1ubuntu1","22.0.0-0ubuntu2","22.0.1-1ubuntu1","22.0.1-1ubuntu2","22.0.1-1ubuntu2.1","22.0.5-0ubuntu0.1","22.0.5-0ubuntu0.3","22.2.5-0ubuntu0.1~22.04.1","22.2.5-0ubuntu0.1~22.04.2","22.2.5-0ubuntu0.1~22.04.3","23.0.4-0ubuntu1~22.04.1","23.2.1-1ubuntu3.1~22.04.2","23.2.1-1ubuntu3.1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2.8-0ubuntu0.24.04.2"}]}],"versions":["23.2.1-1ubuntu3","23.2.1-1ubuntu4","23.3.0-2ubuntu3","23.3.3-1ubuntu2","24.0.1-1ubuntu1","24.0.3-1ubuntu3","24.0.3-1ubuntu4","24.0.5-1ubuntu1","24.0.9-0ubuntu0.1","24.0.9-0ubuntu0.2","24.0.9-0ubuntu0.3","24.2.8-1ubuntu1~24.04.1","25.0.7-0ubuntu0.24.04.1","25.0.7-0ubuntu0.24.04.2","25.2.8-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mesa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2.8-0ubuntu0.25.10.2"}]}],"versions":["25.0.3-1ubuntu2","25.0.7-0ubuntu1","25.0.7-0ubuntu2","25.0.7-0ubuntu3","25.1.5-1ubuntu1","25.1.7-1ubuntu1","25.2.1-2ubuntu1","25.2.2-1ubuntu1","25.2.3-1ubuntu1","25.2.8-0ubuntu0.25.10.1"]}],"products":[{"vendor":"mesa3d","product":"mesa"}],"references":[{"url":"https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html","tags":["Issue Tracking","Mailing List","report"]},{"url":"https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866","tags":["Issue Tracking","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40393","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w54f-pw7x-c532"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-40393","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787314086.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40393","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2048","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2049","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2050","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2051","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2052","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261343-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261998","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40393","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261835-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261839-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261844-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261845-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621412-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621534-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261911","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621564-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40393","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40393","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8427-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40393","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T18:49:18.984Z","modified":"2026-07-13T09:05:05.539Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-21737","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T18:49:18Z","modified":"2026-07-13T09:05:05Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:02.308684Z"}],"ghsa":[{"id":"GHSA-w54f-pw7x-c532","title":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU...","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T21:30:18Z","modified":"2026-07-13T12:36:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:25.900925Z"}],"nvd":[{"id":"CVE-2026-40393","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T19:16:20.797Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"BELL-CVE-2026-40393","status":"published","published":"2026-04-15T06:10:21.69254Z","modified":"2026-04-25T07:22:32.856917Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"DEBIAN-CVE-2026-40393","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T19:16:20.797Z","modified":"2026-10-27T09:47:36.014811504Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2048","title":"mesa security update","description":".\r\n\r\nSecurity Fix(es):\n\nIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:49.438493715Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2049","title":"mesa security update","description":".\r\n\r\nSecurity Fix(es):\n\nIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:48.492576369Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2050","title":"mesa security update","description":".\r\n\r\nSecurity Fix(es):\n\nIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:48.534610243Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2051","title":"mesa security update","description":".\r\n\r\nSecurity Fix(es):\n\nIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:49.116189933Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2052","title":"mesa security update","description":".\r\n\r\nSecurity Fix(es):\n\nIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:48.992106457Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-40393","title":"CVE-2026-40393 in mesa - Patched by Root","description":"Root has patched CVE-2026-40393 in the mesa package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-07T07:34:00Z","modified":"2026-10-09T13:00:06.466691838Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-40393","title":"CVE-2026-40393 in rootio-mesa - Patched by Root","description":"Root has patched CVE-2026-40393 in the rootio-mesa package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-06-25T13:37:38Z","modified":"2026-08-27T14:00:07.880641375Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-40393","title":"CVE-2026-40393 in rootio-mesa - Patched by Root","description":"Root has patched CVE-2026-40393 in the rootio-mesa package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-04-17T15:07:42Z","modified":"2026-08-27T14:00:04.444314551Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-40393","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T19:16:00Z","modified":"2026-11-09T12:49:54.203481355Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"AZL-82688","title":"CVE-2026-40393 affecting package mesa for versions less than 24.0.1-8","description":"In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.","status":"published","published":"2026-04-12T19:16:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1787314086","title":"Fix CVE(s): CVE-2026-40393","description":"   * SECURITY UPDATE: out-of-bounds memory access from an unbounded stack\n     allocation in the SPIR-V front end (ELSCVE-171724)\n     - debian/patches/backport-STACK_ARRAY.patch: add the upstream\n       src/util/stack_array.h helper, which the fix requires.\n     - debian/patches/CVE-2026-40393.patch: replace NIR_VLA, a bare alloca,\n       with STACK_ARRAY at the two sites whose element count comes from the\n       shader, in src/compiler/spirv/spirv_to_nir.c and\n       src/compiler/nir/nir_inline_functions.c.\n     - CVE-2026-40393","status":"published","published":"2026-08-21T12:08:18Z","modified":"2026-10-26T09:31:47.504143788Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:20688-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-06T10:47:00Z","modified":"2026-05-09T18:24:45.733512Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1343-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on\n  an untrusted party (bsc#1261998).\n","status":"published","published":"2026-04-15T10:18:55Z","modified":"2026-04-16T08:30:26.368002Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1835-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on\n  an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-12T16:18:03Z","modified":"2026-05-14T08:16:14.685184Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1839-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on\n  an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-13T09:13:56Z","modified":"2026-05-14T08:16:17.31238Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1844-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on\n  an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-13T15:25:16Z","modified":"2026-05-14T08:15:27.297585Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1845-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on\n  an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-13T15:26:52Z","modified":"2026-05-14T08:15:31.20651Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21292-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).\n","status":"published","published":"2026-04-23T12:23:32Z","modified":"2026-04-28T18:24:11.13492Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21412-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issues:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).\n","status":"published","published":"2026-04-24T13:11:17Z","modified":"2026-05-01T18:27:00.947425Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21534-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-06T10:26:38Z","modified":"2026-05-12T18:26:21.908801Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21564-1","title":"Security update for Mesa","description":"This update for Mesa fixes the following issue:\n\n- CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).\n","status":"published","published":"2026-05-06T10:26:38Z","modified":"2026-05-12T18:27:42.597636Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8427-1","title":"mesa vulnerability","description":"It was discovered that Mesa did not properly validate memory allocation\nsizes in WebGPU under certain circumstances. An attacker could use this\nissue to cause Mesa to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","status":"published","published":"2026-06-15T12:01:35Z","modified":"2026-06-15T20:18:55.607946437Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}