# CVE-2026-86314: Samsung Walrus integer overflow in memory bounds check

Source: https://junglewise.ai/threats/cve-2026-86314-samsung-walrus-integer-overflow-in-memory-bounds-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86314 · Severity: medium · CVSS 6.2 · Published 2026-09-07

Samsung Walrus is a WebAssembly runtime engine used to execute WebAssembly modules. An integer overflow vulnerability in its memory initialization code allows a remote attacker to bypass security bounds checks and read memory outside the intended buffer, potentially causing the application to crash or leak sensitive data.

Technologies: [Samsung Walrus](https://junglewise.ai/threats/technologies/walrus). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-86314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86314 being exploited in the wild.

**How severe is CVE-2026-86314?** Medium severity, with a CVSS score of 6.2, published 7 September 2026.

**Which products and versions are affected?** Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier.

**Is there a fix for CVE-2026-86314?** A patch was published on 2026-08-21: Fix merged in Samsung/walrus PR #482 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86314 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86314?** Check whether you run Samsung Walrus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow exists in the Memory::init() function (src/runtime/Memory.cpp) where a 32-bit unsigned addition wraps around, bypassing the source-bounds check. An attacker can craft a malicious WebAssembly module that triggers this overflow, causing out-of-bounds heap reads. The vulnerability is reachable remotely via WebAssembly module loading with no authentication required. The impact includes denial of service and potential information disclosure through memory read leaks.

## Affected products

- Samsung Walrus ff3bf5ff5c4878f8e5572c9593d303f6bc997443 and earlier

## Timeline

- 2026-09-07: disclosed: CVE-2026-86314 published
- 2026-08-21: patched: Fix merged in Samsung/walrus PR #482

## References

- [https://github.com/Samsung/walrus/pull/482](https://github.com/Samsung/walrus/pull/482)

## Related threats

- [Samsung Walrus out-of-bounds write buffer overflow](https://junglewise.ai/threats/cve-2026-86313-samsung-walrus-out-of-bounds-write-buffer-overflow)
- [Samsung Walrus NULL pointer dereference](https://junglewise.ai/threats/cve-2026-47308-samsung-walrus-null-pointer-dereference)
- [Samsung Walrus NULL pointer dereference in WebAssembly engine](https://junglewise.ai/threats/cve-2026-47307-samsung-walrus-null-pointer-dereference-in-webassembly-engine)