CVE-2026-47307: Null Pointer Dereference

Published May 19, 2026

Updated

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions.

This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.

Affected Software

2 affected components

Samsung Walrus=f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9

Samsung Walrus=2026-04-27

Remediation

Patch Available

https://github.com/Samsung/walrus/pull/409

Event History

May 19, 2026

CVE Published

via MITRE·02:51 AM

Data Sourced

via MITRE·02:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-47307?

CVE-2026-47307 has a severity rating that could lead to denial of service due to a NULL pointer dereference.

How do I fix CVE-2026-47307?

To fix CVE-2026-47307, update the Samsung Walrus to the latest version that addresses this vulnerability.

What software is affected by CVE-2026-47307?

CVE-2026-47307 specifically affects Samsung Walrus version f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.

What causes the CVE-2026-47307 vulnerability?

CVE-2026-47307 is caused by a NULL pointer dereference that occurs when processing deeply nested instructions in a crafted WebAssembly module.

Can CVE-2026-47307 be exploited remotely?

Yes, CVE-2026-47307 can be exploited remotely, allowing attackers to deliver a malicious WebAssembly module to trigger the denial of service.