What is the CVSS score of CVE-2026-47307?

CVE-2026-47307 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Samsung Walrus CVE-2026-47307

EUVD-2026-30823 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-05-19 samsung.tv_appliance

GHSA-9x57-pvwj-p59f

Samsung Null Pointer Dereference Denial Of Service

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 03:45 vuln.today

Analysis Generated

May 19, 2026 - 03:45 vuln.today

DescriptionCVE.org

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions.

This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.

AnalysisAI

NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of service when a crafted .wasm module containing deeply nested instructions is loaded. The vulnerability affects the Walrus runtime at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9 (CPE: cpe:2.3:a:samsung_open_source:walrus) and is classified CVSS 5.5 Medium with a local attack vector requiring user interaction. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; an upstream fix is available in GitHub PR #409 but a tagged release version has not been independently confirmed.

Technical ContextAI

Samsung Walrus is an open-source WebAssembly (Wasm) interpreter/runtime developed by Samsung. The vulnerability resides in src/parser/WASMParser.cpp within the WASMBinaryReader class, which processes WebAssembly binary instruction sequences during module loading. CWE-476 (NULL Pointer Dereference) is triggered because, when the parser encounters deeply nested instruction blocks, it enters an internal error state but continues execution without checking that state - eventually dereferencing a NULL or invalidated pointer. The PR #409 fix adds explicit early-return guards across at least eleven parsing callback methods, introduces a PARSER_RESOURCE_LIMIT check for local variable declaration counts, and refactors error state management from the WASMBinaryReader inner class into the WASMBinaryReaderDelegate base class, exposing it via a new CheckParseError() method used in the wabt binary reader delegate layer. The root cause is insufficient bounds and error-state checking during recursive instruction parsing, a pattern common in Wasm runtimes processing adversarial inputs.

RemediationAI

The upstream fix is available in GitHub PR #409 (https://github.com/Samsung/walrus/pull/409), which adds early-return error guards in WASMParser.cpp and a PARSER_RESOURCE_LIMIT enforcement for local declarations; however, a tagged, versioned release incorporating this fix has not been independently confirmed, so users building Walrus from source should apply the PR #409 changes directly by rebasing to a commit that includes them. As a compensating control where patching is not immediately possible, applications embedding Walrus should perform pre-validation of .wasm inputs - rejecting modules that exceed reasonable size thresholds or nesting depth limits before passing them to the parser, trading some compatibility for crash resilience. Additionally, restricting which users or pipeline components can supply WebAssembly modules to the Walrus-embedding application reduces the attacker's ability to deliver a crafted input, partially mitigating the local attack vector.