CVE-2025-13952CWE-416

GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP

Critical · published January 24, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

🚨 A rogue web page with GPU shader code can trigger a crash in the shader compiler, potentially leading to catastrophic exploits! 🔥 Think of this like a sneaky hacker slipping a faulty part into a factory assembly line, causing equipment to fail and exposing the entire operation to a world of trouble. The GPU shader compiler is the factory's machine, and this bug lets attackers tamper with its operations. If exploited, this vulnerability could allow attackers to crash the GPU compiler, leveraging system privileges to execute arbitrary code. This is a dream come true for hackers, as it could lead to a complete takeover of the device, compromising sensitive data and system integrity. The stakes are nothing short of devastating!

Put simply

Think of this like a sneaky hacker slipping a faulty part into a factory assembly line, causing equipment to fail and exposing the entire operation to a world of trouble. The GPU shader compiler is the factory's machine, and this bug lets attackers tamper with its operations. This vulnerability involves a write use-after-free condition in the GPU shader compiler library caused by outdated pointer references in shader code fetched from the internet. When the compiler runs with system privileges, it becomes a prime target for further exploits.

What to do

If exploited, this vulnerability could allow attackers to crash the GPU compiler, leveraging system privileges to execute arbitrary code. This is a dream come true for hackers, as it could lead to a complete takeover of the device, compromising sensitive data and system integrity. The stakes are nothing short of devastating! Immediately patch affected systems to ensure that the GPU compiler library is updated and free from this vulnerability. Review configurations and restrict the execution of GPU shader code from untrusted sources. As always, prioritize security updates to maintain a strong defensive posture. You've got this! Follow these steps, and you'll keep your systems secure and resilient against sneaky attacks! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-24T02:26Z
EPSS history
Timeline
  • 24 JAN 02:26Z
    GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP
    cvelistv5