This vulnerability (CVE-2026-6839) in Samsung Open Source ONE arises from improper validation of specified quantities related to string tensor offsets. Specifically, malformed string metadata can cause out-of-bounds memory access during the import of constant tensors. The affected versions are those prior to commit 1.30.0. The CVSS 3.1 base score is 6.6, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited impact on confidentiality and integrity but high impact on availability.

Successful exploitation could result in out-of-bounds memory access, potentially leading to denial of service or other availability impacts. Confidentiality and integrity impacts are rated low. There are no known exploits in the wild. The vulnerability requires local access and user interaction, limiting the attack surface.

No official patch or remediation level has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed string tensor metadata in affected versions. Monitor vendor communications for updates on patches or mitigations.