CVE-2026-41665

Full vulnerability record from the local CVENow database.

Description

Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to commit 1.30.0.

Severity

MEDIUM

CVSS score

6.1 (v3.1)

Vulnerability status

Analyzed

Source identifier

[email protected]

Published

2026-04-22 07:16:13.763000

Last modified

2026-10-26 21:10:00.170000

View original CVE JSON

{
  "id": "CVE-2026-41665",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-22T07:16:13.763",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors.\nAffected version is prior to commit  1.30.0."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de entero en el cálculo del tamaño de inicialización del búfer temporal en Samsung Open Source ONE causa una inicialización de memoria incorrecta para tensores intermedios grandes.\nLa versión afectada es anterior al commit 1.30.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Samsung Open Source",
          "product": "ONE",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.30.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T12:34:23.156612Z",
          "id": "CVE-2026-41665",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:samsung:one:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.30.0",
              "matchCriteriaId": "4DBBA2E4-036F-40C0-B2EF-D14AB3C83B6E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Samsung/ONE/pull/16481",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}