CVE-2026-6839

{
  "id": "CVE-2026-6839",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-22T07:16:14.957",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE\nAffected version is prior to commit  1.30.0."
    },
    {
      "lang": "es",
      "value": "Validación incorrecta de los desplazamientos de tensores STRING podría permitir que metadatos de cadena malformados desencadenen un acceso fuera de límites durante la importación de tensores constantes en Samsung Open Source ONE.\nLa versión afectada es anterior al commit 1.30.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Samsung Open Source",
          "product": "ONE",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.30.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T12:29:51.595229Z",
          "id": "CVE-2026-6839",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:samsung:one:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.30.0",
              "matchCriteriaId": "4DBBA2E4-036F-40C0-B2EF-D14AB3C83B6E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Samsung/ONE/pull/16481",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}