EUVD-2026-30823
GHSA-9x57-pvwj-p59f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions.
This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
AnalysisAI
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of service when a crafted .wasm module containing deeply nested instructions is loaded. The vulnerability affects the Walrus runtime at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9 (CPE: cpe:2.3:a:samsung_open_source:walrus) and is classified CVSS 5.5 Medium with a local attack vector requiring user interaction. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; an upstream fix is available in GitHub PR #409 but a tagged release version has not been independently confirmed.
Technical ContextAI
Samsung Walrus is an open-source WebAssembly (Wasm) interpreter/runtime developed by Samsung. The vulnerability resides in src/parser/WASMParser.cpp within the WASMBinaryReader class, which processes WebAssembly binary instruction sequences during module loading. CWE-476 (NULL Pointer Dereference) is triggered because, when the parser encounters deeply nested instruction blocks, it enters an internal error state but continues execution without checking that state - eventually dereferencing a NULL or invalidated pointer. The PR #409 fix adds explicit early-return guards across at least eleven parsing callback methods, introduces a PARSER_RESOURCE_LIMIT check for local variable declaration counts, and refactors error state management from the WASMBinaryReader inner class into the WASMBinaryReaderDelegate base class, exposing it via a new CheckParseError() method used in the wabt binary reader delegate layer. The root cause is insufficient bounds and error-state checking during recursive instruction parsing, a pattern common in Wasm runtimes processing adversarial inputs.
RemediationAI
The upstream fix is available in GitHub PR #409 (https://github.com/Samsung/walrus/pull/409), which adds early-return error guards in WASMParser.cpp and a PARSER_RESOURCE_LIMIT enforcement for local declarations; however, a tagged, versioned release incorporating this fix has not been independently confirmed, so users building Walrus from source should apply the PR #409 changes directly by rebasing to a commit that includes them. As a compensating control where patching is not immediately possible, applications embedding Walrus should perform pre-validation of .wasm inputs - rejecting modules that exceed reasonable size thresholds or nesting depth limits before passing them to the parser, trading some compatibility for crash resilience. Additionally, restricting which users or pipeline components can supply WebAssembly modules to the Walrus-embedding application reduces the attacker's ability to deliver a crafted input, partially mitigating the local attack vector.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today