This vulnerability (CVE-2026-6839) in Samsung Open Source ONE is caused by improper validation of specified quantities related to string tensor offsets. Malformed string metadata can trigger out-of-bounds memory access during the import of constant tensors. The affected versions are those prior to commit 1.30.0. The CVSS 3.1 base score is 6.6, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts on confidentiality, integrity, and high impact on availability. No patch or official remediation level has been published yet.

Successful exploitation could lead to out-of-bounds memory access, potentially causing denial of service or limited information disclosure. The impact on confidentiality and integrity is low, while availability impact is high. Exploitation requires local access and user interaction, limiting the attack surface. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted or malformed string tensor metadata and restrict local access to trusted users only. Monitor vendor channels for updates regarding patches or mitigations.