Executive brief
Samsung Walrus is a WebAssembly runtime engine used to execute WebAssembly modules. An integer overflow vulnerability in its memory initialization code allows a remote attacker to bypass security bounds checks and read memory outside the intended buffer, potentially causing the application to crash or leak sensitive data.
Technical details
An integer overflow exists in the Memory::init() function (src/runtime/Memory.cpp) where a 32-bit unsigned addition wraps around, bypassing the source-bounds check. An attacker can craft a malicious WebAssembly module that triggers this overflow, causing out-of-bounds heap reads. The vulnerability is reachable remotely via WebAssembly module loading with no authentication required. The impact includes denial of service and potential information disclosure through memory read leaks.
Affected products
- Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier
Timeline
- 2026-09-07: disclosed: CVE-2026-86314 published
- 2026-08-21: patched: Fix merged in Samsung/walrus PR #482