CVE-2026-86314 PUBLISHED

Assigner: samsung.tv_appliance
Reserved: 07.09.2026 Published: 07.09.2026 Updated: 07.09.2026

Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check.

This issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.2

Product Status

Vendor Samsung Opensource
Product Walrus
Versions Default: unaffected
  • Version ff3bf5ff5c4878f8e5572c9593d303f6bc997443 is affected

Credits

  • Ezinne Kalu finder

References

Problem Types

  • CWE-190 Integer overflow or wraparound CWE

Impacts

  • CAPEC-92 Forced Integer Overflow