CVE-2026-21734: GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reduce or remove system privileges for the GPU compiler process on affected platforms to limit the impact of a GPU shader compiler crash (e.g., run the compiler under least-privilege instead of system privileges).
- Compensating control
Validate/sanitize or block WebGPU shader code that includes unusually complex or malformed shader code before it is passed to the GPU compiler process to prevent triggering the out-of-bounds write crash in the GPU shader compiler library.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21734?
The risk rating for CVE-2026-21734 is 60, indicating a moderate severity level.
How do I fix CVE-2026-21734?
To address CVE-2026-21734, ensure that the GPU driver is updated to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-21734?
CVE-2026-21734 is an out-of-bounds write vulnerability that can occur during WebGPU shader compilation.
Which software is affected by CVE-2026-21734?
CVE-2026-21734 specifically impacts the GPU DDK libusc related to GPU shader compilation.
Can CVE-2026-21734 lead to further exploits?
Yes, if exploited on certain platforms with system privileges, CVE-2026-21734 could potentially enable further exploits on the device.