An out-of-bounds memory allocation occurs in Mesa's WebGPU implementation when an untrusted length value determines the size of a stack allocation via alloca. This logic flaw allows an attacker to request memory that exceeds the allocated bounds, leading to possible memory corruption or arbitrary writes in the driver context, which could be leveraged for remote code execution or data tampering.

The issue affects the Mesa 3D graphics library on all platforms that include its WebGPU support. Versions before 25.3.6 in the 25.x series and before 26.0.1 in the 26.x series are vulnerable. Any system using one of those releases and running applications that expose WebGPU (such as modern browsers or graphics tools) may be exposed.

The CVSS v3.1 score of 8.1 places it in the high-severity range, indicating significant potential impact on confidentiality, integrity and availability. No EPSS score is available and the vulnerability is not yet listed in CISA’s KEV catalog, implying no publicly confirmed exploit at this time. However, the likely attack vector involves an attacker supplying crafted WebGPU commands from an untrusted source, so timely patching is essential to mitigate risk.