CVE-2026-86314: Integer Overflow
Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check.
This issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the denial of service?
The attacker must cause Walrus to process a crafted WebAssembly module whose source bounds values make a 32-bit unsigned addition wrap around. No privileges or user interaction are required according to the supplied CVSS vector.
Which deployments are affected?
The issue is described as affecting Samsung Walrus on all platforms at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443. Deployments that process remotely supplied or attacker-controlled WebAssembly modules are the relevant exposure scenario.
What is the expected impact?
Successful exploitation can bypass the source-bounds check, leading to an out-of-bounds heap read and denial of service. The provided vector indicates no stated confidentiality or integrity impact, with availability impact rated high.