Is CVE-2026-86314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86314 being exploited in the wild.

How severe is CVE-2026-86314?

Medium severity, with a CVSS score of 6.2, published 7 September 2026.

Which products and versions are affected?

Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier.

Is there a fix for CVE-2026-86314?

A patch was published on 2026-08-21: Fix merged in Samsung/walrus PR #482 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86314 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86314?

Check whether you run Samsung Walrus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86314: Samsung Walrus integer overflow in memory bounds check

CVE-2026-86314 · Severity: medium · CVSS 6.2 · Published 2026-09-07

Samsung Walrus is a WebAssembly runtime engine used to execute WebAssembly modules. An integer overflow vulnerability in its memory initialization code allows a remote attacker to bypass security bounds checks and read memory outside the intended buffer, potentially causing the application to crash or leak sensitive data.

Technologies: Samsung Walrus. Vendors: Samsung.

Quick answers

Is CVE-2026-86314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86314 being exploited in the wild.
How severe is CVE-2026-86314?: Medium severity, with a CVSS score of 6.2, published 7 September 2026.
Which products and versions are affected?: Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier.
Is there a fix for CVE-2026-86314?: A patch was published on 2026-08-21: Fix merged in Samsung/walrus PR #482 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86314 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86314?: Check whether you run Samsung Walrus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in the Memory::init() function (src/runtime/Memory.cpp) where a 32-bit unsigned addition wraps around, bypassing the source-bounds check. An attacker can craft a malicious WebAssembly module that triggers this overflow, causing out-of-bounds heap reads. The vulnerability is reachable remotely via WebAssembly module loading with no authentication required. The impact includes denial of service and potential information disclosure through memory read leaks.

Affected products

Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier

Timeline

2026-09-07: disclosed: CVE-2026-86314 published
2026-08-21: patched: Fix merged in Samsung/walrus PR #482

References

https://github.com/Samsung/walrus/pull/482

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.