EUVD-2026-72236
GHSA-c8rr-65vc-ghcg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local execution of attacker-supplied WASM required (AV:L); no OS privileges needed (PR:N); user must initiate WASM execution (UI:R); full heap corruption achieves C/I/A:H.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers.
This issue affects Walrus: af80e665ea49d9003695a66502f841ed1d8397e7.
AnalysisAI
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a memcpy in WASI02Impl.cpp that copies the requested read length (size) rather than the actual bytes read (read) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running Samsung Walrus to process a WebAssembly component that exercises WASI 0.2 stream reads (`[method]input-stream.read`) - specifically, the stream must return fewer bytes than the requested read length (a short read or EOF condition), which is a normal and easily provoked I/O outcome. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects local exploitation of a crafted WASM file requiring user interaction to execute. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Rebuild Walrus from a commit incorporating PR #482 (https://github.com/Samsung/walrus/pull/482), which corrects the `memcpy` length argument in `src/wasi/WASI02Impl.cpp` from `size` to `read` and removes the defective type-index bounds check in `src/parser/WASMComponentParser.cpp`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and applications using Samsung Walrus WebAssembly runtime and assess their criticality to business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who suppl
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today