What is the CVSS score of CVE-2026-40450?

CVE-2026-40450 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Samsung Open Source ONE CVE-2026-40450

EUVD-2026-24618 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-04-22 samsung.tv_appliance

GHSA-85g4-fxfm-w35m

Samsung Integer Overflow Buffer Overflow

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 06:49 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:30 euvd

EUVD-2026-24618

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

CVE Published

Apr 22, 2026 - 05:53 nvd

MEDIUM 6.6

DescriptionCVE.org

Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors. Affected version is prior to commit 1.30.0.

AnalysisAI

Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.

Technical ContextAI

Samsung Open Source ONE is a neural network compiler and runtime framework designed to optimize and execute deep learning models across diverse hardware platforms. The vulnerability resides in the tensor copying mechanism, specifically in the size calculation logic for output tensor memory operations. When processing tensors, the framework computes the destination buffer size using integer arithmetic; an integer overflow in this calculation causes the computed copy length to wrap around to a small value, while the actual data to be copied is much larger. This mismatch between the calculated size and actual data volume results in out-of-bounds memory writes into adjacent heap or stack memory. CWE-190 (Integer Overflow or Wraparound) is the root cause class, compounded by insufficient bounds checking before the memory copy operation (CWE-680 class territory). The affected CPE string cpe:2.3:a:samsung_open_source:one:*:*:*:*:*:*:*:* indicates all versions of the ONE framework are in scope, with the fix boundary at commit 1.30.0.

RemediationAI

Upgrade Samsung Open Source ONE to version 1.30.0 or later. The patch addresses the integer overflow in tensor copy size calculation by implementing proper bounds checking and using safe arithmetic functions. Users unable to immediately upgrade should restrict tensor input processing to trusted sources, avoid loading neural network models or tensor files from untrusted or user-supplied origins, and consider running ONE inference in sandboxed or containerized environments with memory protection to limit the scope of potential memory corruption. Validate tensor dimensions and sizes at model load time as a compensating control, though this may not catch all edge cases triggering the integer overflow. Monitor Samsung ONE security advisories (https://github.com/Samsung/ONE) for additional guidance and backport patches if version upgrades are delayed.