CVE-2026-6839
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Improper validation of STRING tensor offsets allows malformed string metadata to trigger out-of-bounds access during constant tensor import in Samsung Open Source ONE. Affected versions are prior to commit 1.30.0.
Risk Assessment
A malicious model or file could cause an out-of-bounds memory access, potentially leading to a crash or code execution in the context of the processing application.
Recommendation
Update Samsung Open Source ONE to a version including commit 1.30.0 or later.
Other vulnerabilities in Samsung Open Source ONE
See all- CVE-2026-41667Medium
An integer overflow occurs in Samsung Open Source ONE when calculating the data size of constant tensors. This can lead to incorrect buffer sizing for large constant nodes. The affected version is prior to commit 1.30.0.
- CVE-2026-41666Medium
Integer overflow in tensor copy size calculation in Samsung Open Source ONE can lead to out-of-bounds access during loop state propagation. Affects versions prior to commit 1.30.0.
- CVE-2026-41665Medium
Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE causes incorrect memory initialization for large intermediate tensors. Affects versions prior to commit 1.30.0.
- CVE-2026-41664Medium
Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes. Affected version is prior to commit 1.30.0.
- CVE-2026-40450Medium
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE can cause incorrect copy length and memory corruption for oversized tensors. Affects versions prior to commit 1.30.0.
- CVE-2026-40449Medium
Integer overflow in buffer size calculation can result in out-of-bounds memory access when handling large tensors in Samsung Open Source ONE. Affects versions prior to commit 1.30.0.
- CVE-2026-40448Medium
Samsung Open Source ONE has a potential integer overflow in tensor allocation size calculation, which could lead to insufficient memory allocation for large tensors. Affected versions are prior to commit 1.30.0.
Original NVD description (English source)
Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE Affected version is prior to commit 1.30.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS