CVE-2026-40449

Improper validation of STRING tensor offsets allows malformed string metadata to trigger out-of-bounds access during constant tensor import in Samsung Open Source ONE. Affected versions are prior to commit 1.30.0.

An integer overflow occurs in Samsung Open Source ONE when calculating the data size of constant tensors. This can lead to incorrect buffer sizing for large constant nodes. The affected version is prior to commit 1.30.0.

Integer overflow in tensor copy size calculation in Samsung Open Source ONE can lead to out-of-bounds access during loop state propagation. Affects versions prior to commit 1.30.0.

Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE causes incorrect memory initialization for large intermediate tensors. Affects versions prior to commit 1.30.0.

Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes. Affected version is prior to commit 1.30.0.

Integer overflow in output tensor copy size calculation in Samsung Open Source ONE can cause incorrect copy length and memory corruption for oversized tensors. Affects versions prior to commit 1.30.0.

Samsung Open Source ONE has a potential integer overflow in tensor allocation size calculation, which could lead to insufficient memory allocation for large tensors. Affected versions are prior to commit 1.30.0.