{"id":"CVE-2026-86314","title":"Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module…","summary":"Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190"],"vendor":"Samsung Opensource","product":"Walrus","affected":["Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443"],"published":"2026-09-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:50.263","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86314","references":[{"url":"https://github.com/Samsung/walrus/pull/482","label":"PSIRT@samsung.com"}],"tags":["nvd","cve.org"],"epss":0.00125,"epssPercentile":0.02583,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T15:23:47.230905Z"},"ingestedAt":"2026-09-08T16:34:19.218Z","slug":"CVE-2026-86314","body":"## Overview\n\nInteger overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check.\n\n\n\nThis issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}