Executive brief
Samsung Walrus is an open-source WebAssembly runtime that can be embedded in applications to execute WebAssembly code safely. An out-of-bounds write vulnerability in Walrus allows an attacker to overflow buffers, potentially enabling arbitrary code execution or crashing the application. This could impact any software that relies on Walrus to isolate and execute untrusted WebAssembly code.
Technical details
The vulnerability is a classic out-of-bounds write flaw in Samsung's Walrus WebAssembly runtime (commit af80e665ea49d9003695a66502f841ed1d8397e7). The vulnerability permits buffer overflow, allowing an attacker to write data beyond allocated memory boundaries. The attack vector is through crafted WebAssembly code that triggers the out-of-bounds write during runtime execution; no special authentication or elevated privileges are required beyond the ability to provide input to the runtime. A successful exploit could lead to memory corruption, denial of service, or potentially code execution depending on the specific memory layout and exploitability. A fix has been merged in Samsung's repository (PR #482), addressing the WASI compatibility issues and related test system updates.
Affected products
- Samsung Walrus commit af80e665ea49d9003695a66502f841ed1d8397e7 and prior
Timeline
- 2026-09-07: disclosed
- 2026-08-21: patched: Fix merged in PR #482