Samsung Opensource
Monthly
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Out-of-bounds read in Samsung's rlottie animation library (not Escargot as the CVE metadata incorrectly states) exposes consumers of the library - including Samsung TV appliances - to information disclosure and potential parser crashes when processing specially crafted JPEG images. The root cause is the absence of fractional-ratio validation in stb_image.h's JPEG frame header processor: when h_max is not evenly divisible by a color component's sampling factor, the resampler accesses memory beyond the intended buffer boundary. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Out-of-bounds read in Samsung's rlottie animation library (not Escargot as the CVE metadata incorrectly states) exposes consumers of the library - including Samsung TV appliances - to information disclosure and potential parser crashes when processing specially crafted JPEG images. The root cause is the absence of fractional-ratio validation in stb_image.h's JPEG frame header processor: when h_max is not evenly divisible by a color component's sampling factor, the resampler accesses memory beyond the intended buffer boundary. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.