What is the CVSS score of CVE-2026-41667?

CVE-2026-41667 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Samsung Open Source ONE CVE-2026-41667

EUVD-2026-24626 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-04-22 samsung.tv_appliance

GHSA-68gc-c9cv-7m2c

Samsung Integer Overflow Buffer Overflow

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 06:49 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:30 euvd

EUVD-2026-24626

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

CVE Published

Apr 22, 2026 - 05:57 nvd

MEDIUM 6.6

DescriptionCVE.org

Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0.

AnalysisAI

Integer overflow in constant tensor data size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause incorrect buffer sizing for large constant nodes, leading to buffer overflow conditions that may result in information disclosure or denial of service. The vulnerability requires local access and user interaction but can trigger high-severity memory corruption due to incorrect buffer allocation for tensors exceeding integer size limits.

Technical ContextAI

Samsung Open Source ONE is a neural network framework that processes tensor data structures. The vulnerability exists in the constant tensor data size calculation logic, where an integer overflow occurs when computing buffer sizes for large constant nodes. This affects the memory allocation layer responsible for reserving buffers to hold tensor constant values. When the calculated size overflows an integer type, it wraps to a smaller value, causing the allocated buffer to be undersized relative to the actual data being written. The root cause is improper integer arithmetic validation (CWE-190: Integer Overflow or Wraparound) in the tensor initialization code path. CPE cpe:2.3:a:samsung_open_source:one:*:*:*:*:*:*:*:* covers all versions prior to 1.30.0.

RemediationAI

Upgrade Samsung Open Source ONE to version 1.30.0 or later to obtain the integer overflow fix. Users unable to immediately update should implement input validation to reject neural network models with tensor constant sizes exceeding safe integer calculation thresholds (e.g., maximum tensor dimension products that do not cause 32-bit or 64-bit integer overflow depending on the framework's size_t type). Restrict model loading to trusted sources only, as the vulnerability requires user interaction to load a crafted model. Disable automatic model loading or inference features in untrusted environments. Monitor process memory usage during model loading for unexpected buffer allocation patterns that may indicate exploitation attempts. Review the fix in GitHub PR #16481 for implementation details if custom patches are required before version 1.30.0 release.