Samsung Open Source ONE CVE-2026-41667

The vulnerability requires local file system access to provide the malicious model file to the ONE framework. User interaction is mandatory - a user or automated process must explicitly load or parse the crafted neural network model; the vulnerability does not trigger during normal framework operation with legitimate models. No authentication is required to invoke the vulnerable code path once model loading is initiated. Exploitation is specific to models with constant tensor nodes that exhibit size calculation overflow, not all models. The integer overflow must occur within the specific size_t or int type used in the ONE framework's tensor allocation code; the exact threshold depends on whether 32-bit or 64-bit arithmetic is employed. Non-default configurations using ONE's model inference features are assumed; systems that do not load or process neural network models are not at risk.

CVSS 6.6 (Medium-High) with local attack vector and user interaction required significantly limits real-world exploitation scope compared to network-based vulnerabilities. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U indicates a local attacker without privileges can trigger the vulnerability if a user interacts with a crafted model or input. The high Availability impact (A:H) combined with confidentiality and integrity impacts (C:L/I:L) suggests potential for denial of service or data corruption. However, exploitation depends on user interaction (UI:R) - an attacker cannot trigger this remotely or without user action such as loading a malicious neural network model. The integer overflow must be triggered by a specially crafted tensor with dimensions that cause size calculation to exceed integer boundaries. No EPSS score or active exploitation status (KEV) data provided limits quantification of real-world prioritization relative to other local vulnerabilities. The bounded nature of the vulnerability (local, requiring user action) makes this a lower priority than network-exploitable flaws, but the memory corruption potential warrants timely patching for systems that process untrusted neural network models.

An attacker crafts a neural network model file (e.g., in ONE's model format) with a constant tensor node whose dimension product exceeds the maximum value of a 32-bit integer, triggering an integer overflow in size calculation. When a user or application loads and parses this model, the framework allocates a buffer smaller than required due to the overflowed size value. Subsequent operations writing tensor constant data to this undersized buffer trigger a heap buffer overflow, potentially corrupting adjacent memory structures or causing a denial of service crash.