EUVD-2026-24618
GHSA-85g4-fxfm-w35m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors. Affected version is prior to commit 1.30.0.
AnalysisAI
Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.
Technical ContextAI
Samsung Open Source ONE is a neural network compiler and runtime framework designed to optimize and execute deep learning models across diverse hardware platforms. The vulnerability resides in the tensor copying mechanism, specifically in the size calculation logic for output tensor memory operations. When processing tensors, the framework computes the destination buffer size using integer arithmetic; an integer overflow in this calculation causes the computed copy length to wrap around to a small value, while the actual data to be copied is much larger. This mismatch between the calculated size and actual data volume results in out-of-bounds memory writes into adjacent heap or stack memory. CWE-190 (Integer Overflow or Wraparound) is the root cause class, compounded by insufficient bounds checking before the memory copy operation (CWE-680 class territory). The affected CPE string cpe:2.3:a:samsung_open_source:one:*:*:*:*:*:*:*:* indicates all versions of the ONE framework are in scope, with the fix boundary at commit 1.30.0.
RemediationAI
Upgrade Samsung Open Source ONE to version 1.30.0 or later. The patch addresses the integer overflow in tensor copy size calculation by implementing proper bounds checking and using safe arithmetic functions. Users unable to immediately upgrade should restrict tensor input processing to trusted sources, avoid loading neural network models or tensor files from untrusted or user-supplied origins, and consider running ONE inference in sandboxed or containerized environments with memory protection to limit the scope of potential memory corruption. Validate tensor dimensions and sizes at model load time as a compensating control, though this may not catch all edge cases triggering the integer overflow. Monitor Samsung ONE security advisories (https://github.com/Samsung/ONE) for additional guidance and backport patches if version upgrades are delayed.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on t
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ON
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to per
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remo
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remot
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiri
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privi
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the n
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today