CVE-2026-47310 is a use-after-free vulnerability in Samsung Open Source Escargot that allows pointer manipulation. The affected version is identified by the commit hash 590345cc6258317c5da850d846ce6baaf2afc2d3. This vulnerability has a high severity with a CVSS score of 7.8, indicating it can lead to high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and there are no known exploits in the wild at this time.
CVE-2026-47309 is an uncontrolled recursion vulnerability in Samsung Open Source Escargot that allows oversized serialized data payloads. This flaw can cause a denial of service by exhausting system resources due to recursive processing. The vulnerability affects a specific Escargot version identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. There is no official patch or remediation level provided at this time. The CVSS score is 5.5, indicating a medium severity impact focused on availability. No known exploits are reported in the wild, and the product is not a cloud service. No geographic targeting is indicated.
CVE-2026-47308 is a NULL pointer dereference vulnerability in the Samsung Open Source Walrus project. This flaw allows pointer manipulation which can lead to a denial of service condition. The vulnerability affects a specific version of Walrus identified by commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9. The CVSS 3.1 base score is 5.5, indicating a medium severity impact primarily due to availability disruption. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild. The vulnerability requires local access with low attack complexity and no privileges, but user interaction is needed. The impact does not include confidentiality or integrity loss, only availability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-47307 is a NULL pointer dereference vulnerability in Samsung Open Source Walrus. It allows an attacker to cause a denial of service by supplying a crafted WebAssembly module with deeply nested instructions. The vulnerability affects a specific version of Walrus identified by commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9. There is no known exploit in the wild and no official patch or remediation guidance has been provided yet. The CVSS score is 5.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-6840 is a medium severity vulnerability in Samsung Open Source ONE prior to version 1.30.0. It involves improper validation of an array index (CWE-129) during model loading, where missing bounds checks on an operator code could allow out-of-range lookups. This vulnerability does not impact confidentiality or integrity but can cause availability issues. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild, and the product is not a cloud service. Users should monitor vendor advisories for updates on remediation.
CVE-2026-6839 is a medium severity vulnerability in Samsung Open Source ONE prior to version 1.30.0. It involves improper validation of string tensor offsets, which can lead to out-of-bounds access during constant tensor import when malformed string metadata is processed. This vulnerability could impact confidentiality, integrity, and availability to a limited extent. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes.
Affected version is prior to commit 1.30.0.
Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation.
Affected version is prior to commit 1.30.0.
Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors.
Affected version is prior to commit 1.30.0.
CVE-2026-41664 is an integer overflow vulnerability in Samsung Open Source ONE prior to version 1.30.0. The flaw occurs during memory copy size calculation when handling large tensor shapes, potentially causing invalid memory operations. The vulnerability has a CVSS 3.1 base score of 6.6, indicating medium severity. There is no official patch or remediation level currently confirmed by the vendor. Exploitation requires local access with limited privileges and user interaction. The impact includes limited confidentiality and integrity loss, with a high impact on availability.
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors.
Affected version is prior to commit 1.30.0.
Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE.
Affected version is prior to commit 1.30.0.
Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE.
Affected version is prior to commit 1.30.0.
CVE-2026-40447 is an integer overflow or wraparound vulnerability in Samsung Open Source Escargot, specifically affecting version 97e8115ab1110bc502b4b5e4a0c689a71520d335. This vulnerability can cause undefined behavior due to improper handling of integer values. The issue has a medium severity rating with a CVSS score of 5.1. There is no known exploit in the wild and no official patch or remediation guidance has been provided yet.
CVE-2026-40446 is a medium severity vulnerability in Samsung Open Source Escargot involving a type confusion flaw (CWE-843) that allows access of a resource using an incompatible type, leading to pointer manipulation. The affected version is identified by the commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335. The vulnerability has a CVSS 3.1 base score of 6.9, indicating a moderate risk with low attack vector (local), high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and there are no known exploits in the wild. The vulnerability is not related to a cloud service and no geographic targeting is indicated.
CVE-2026-25209 is an out-of-bounds read vulnerability in Samsung Open Source Escargot version 97e8115ab1110bc502b4b5e4a0c689a71520d335. This vulnerability can lead to resource leak exposure. It has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no official patch or remediation guidance currently available. No known exploits are reported in the wild. The vulnerability does not affect a cloud service and no geographic targeting is indicated.
CVE-2026-25208 is an integer overflow vulnerability in Samsung Open Source Escargot version 97e8115ab1110bc502b4b5e4a0c689a71520d335. The flaw allows for buffer overflow conditions due to improper handling of integer values. This vulnerability has a high severity rating with a CVSS score of 8.1, indicating it can lead to significant confidentiality, integrity, and availability impacts. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.
CVE-2026-25207 is a high-severity out-of-bounds write vulnerability in Samsung Open Source Escargot, identified as CWE-787. It affects a specific version of Escargot (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335). This vulnerability can cause buffer overflow conditions leading to potential compromise of confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation available at this time, and no known exploits have been reported in the wild.
CVE-2026-25206 is an out-of-bounds read vulnerability in Samsung Open Source Escargot version 97e8115ab1110bc502b4b5e4a0c689a71520d335. This vulnerability can lead to resource leak exposure. It has a CVSS 3.1 base score of 6.7, indicating medium severity. The vulnerability requires local access with high attack complexity and no privileges or user interaction. There is no official patch or remediation information available at this time, and no known exploits in the wild have been reported.
CVE-2026-25205 is a heap-based buffer overflow vulnerability in Samsung Open Source Escargot, identified in a specific commit version. This vulnerability allows an out-of-bounds write, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.4, indicating high severity. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits are reported in the wild. The affected product is not a cloud service, so remediation depends on vendor or user action. No specific countries are identified as affected.