Samsung Open Source ONE CVE-2026-41664

The vulnerability requires local system access (AV:L) and user interaction to trigger. Specifically, exploitation requires a user or application to load and process a specially crafted tensor or machine learning model file containing tensor shapes with dimensions designed to overflow the integer size calculation. The overflow occurs during the memory allocation phase for tensor data copying. Default configurations of Samsung Open Source ONE are vulnerable; there is no configuration flag or deployment mode that eliminates the risk without upgrading. The attack is not feasible via remote network-only access - the attacker must either execute code locally on the target system or convince a local user to process the malicious input. Systems that exclusively execute pre-validated, internally-developed models are at lower risk than those that process models from external sources or allow dynamic model loading.

CVSS 6.6 reflects moderate-to-high risk with several mitigating factors. Attack vector is local (AV:L), requiring direct system access or a compromised local process, which significantly limits real-world exposure compared to network-based vectors. However, the vulnerability requires no privileges (PR:N), meaning any local user can trigger it. The combination of low attack complexity (AC:L) and user interaction requirement (UI:R) suggests exploitation is straightforward once a user runs a malicious model or tensor input. EPSS data is unavailable from the provided input, preventing probabilistic exploitation assessment. The vulnerability affects confidentiality (C:L), integrity (I:L), and availability (A:H), with the high availability impact indicating potential memory corruption leading to crashes or undefined behavior. The local+UI requirement places this below critical severity but above negligible risk for systems where untrusted machine learning models are executed or tensor data is processed from untrusted sources (e.g., model serving, federated learning scenarios). The lack of KEV status and public exploit code suggests limited real-world exploitation to date, though the technical simplicity (integer overflow) and accessibility via untrusted model inputs represent genuine risk in ML-heavy environments.

An attacker crafts a machine learning model file or directly constructs a tensor with excessively large shape dimensions (e.g., a tensor with dimensions summing to values that trigger integer overflow). When a user or application loads and processes this model through Samsung Open Source ONE, the integer overflow in memory size calculation causes a buffer smaller than required to be allocated. Subsequent memory copy operations write beyond allocated boundaries, corrupting heap memory or triggering a crash. If the attacker controls model serving endpoints or distributes poisoned pre-trained models, this becomes a practical attack vector against ML applications.