CVE-2026-86314: CWE-190 Integer overflow or wraparound in Samsung Opensource Walrus

The vulnerability in Samsung Opensource Walrus involves an integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp). A 32-bit unsigned addition wraps around, allowing a crafted WebAssembly module to bypass bounds checks, leading to an out-of-bounds heap read and denial of service. This issue affects the Walrus component at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443. The CVSS 3.1 base score is 6.2, indicating a medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

An attacker with local access can cause a denial of service by triggering an out-of-bounds heap read through a crafted WebAssembly module exploiting the integer overflow. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a patch is available, avoid processing untrusted WebAssembly modules with the affected Walrus component.