---
id: CVE-2026-86314
title: >-
  Integer overflow in the source-bounds check in Memory::init()
  (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote
  attacker to cause an out-of-bounds heap read and denial of service via a
  crafted WebAssembly module…
summary: >-
  Integer overflow in the source-bounds check in Memory::init()
  (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote
  attacker to cause an out-of-bounds heap read and denial of service via a
  crafted WebAssembly module…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-190
vendor: Samsung Opensource
product: Walrus
affected:
  - Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:09:50.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86314'
references:
  - url: 'https://github.com/Samsung/walrus/pull/482'
    label: PSIRT@samsung.com
tags:
  - nvd
  - cve.org
epss: 0.00181
epssPercentile: 0.0682
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T15:23:47.230905Z'
ingestedAt: '2026-09-08T16:34:19.218Z'
---

## Overview

Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check.



This issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.