CVE-2026-41667
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An integer overflow occurs in Samsung Open Source ONE when calculating the data size of constant tensors. This can lead to incorrect buffer sizing for large constant nodes. The affected version is prior to commit 1.30.0.
Risk Assessment
This may cause memory corruption, application crashes, or other issues related to incorrect buffering. Organizations using this library are exposed to instability or potential exploitation.
Recommendation
Update Samsung Open Source ONE to the version containing commit 1.30.0 or later. Verify that applications using this library do not process untrusted tensor data.
Other vulnerabilities in Samsung Open Source ONE
See all- CVE-2026-6839Medium
Improper validation of STRING tensor offsets allows malformed string metadata to trigger out-of-bounds access during constant tensor import in Samsung Open Source ONE. Affected versions are prior to commit 1.30.0.
- CVE-2026-41666Medium
Integer overflow in tensor copy size calculation in Samsung Open Source ONE can lead to out-of-bounds access during loop state propagation. Affects versions prior to commit 1.30.0.
- CVE-2026-41665Medium
Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE causes incorrect memory initialization for large intermediate tensors. Affects versions prior to commit 1.30.0.
- CVE-2026-41664Medium
Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes. Affected version is prior to commit 1.30.0.
- CVE-2026-40450Medium
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE can cause incorrect copy length and memory corruption for oversized tensors. Affects versions prior to commit 1.30.0.
- CVE-2026-40449Medium
Integer overflow in buffer size calculation can result in out-of-bounds memory access when handling large tensors in Samsung Open Source ONE. Affects versions prior to commit 1.30.0.
- CVE-2026-40448Medium
Samsung Open Source ONE has a potential integer overflow in tensor allocation size calculation, which could lead to insufficient memory allocation for large tensors. Affected versions are prior to commit 1.30.0.
Original NVD description (English source)
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS