This vulnerability in Samsung Open Source ONE (versions before 1.30.0) arises from missing bounds validation on an operator code lookup during model loading. Specifically, an array index used to access operator codes is not properly checked for validity, potentially allowing out-of-range access. According to the CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), the attack requires local access and user interaction, has low complexity, no privileges required, and impacts availability but not confidentiality or integrity. The vulnerability is classified under CWE-129 (Improper Validation of Array Index).

The vulnerability can cause denial of service or application crashes due to out-of-bounds array access during model loading, impacting availability. There is no impact on confidentiality or integrity. Exploitation requires local access and user interaction, limiting the attack surface. No known exploits exist in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should avoid running untrusted models or code that could trigger the vulnerability. Monitor Samsung Open Source ONE advisories for updates and apply version 1.30.0 or later once available.