CVE-2026-65587: GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change

Published Oct 30, 2026

Updated

A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.

The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour.

Event History

Oct 30, 2026

CVE Published

via MITRE·01:56 AM

Data Sourced

via MITRE·01:56 AM

DescriptionWeakness

Data Sourced

via NVD·02:17 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users whose browsers load web pages containing unusual WebGPU content are exposed, because the content is processed in the GPU GLES render process and can reach the affected GPU user-space driver.

What does an attacker need to exploit it?

An attacker needs to cause a target browser to load a web page with specially crafted or unusual WebGPU content. The provided information does not state that local access, authentication, or user interaction beyond loading the page is required.

What is the likely impact of successful exploitation?

The out-of-bounds write can corrupt adjacent memory, crash the browser or GPU process, or result in undefined behavior. The description identifies memory corruption and possible process crashes, but does not confirm code execution or privilege escalation.

CVE-2026-65587: GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?