CVE-2026-40448 is an integer overflow vulnerability in Samsung Open Source ONE affecting versions prior to 1.30.0 that could cause insufficient memory allocation when processing large tensors. The flaw exists in the tensor allocation size calculation logic and carries a CVSS score of 5.3 (Medium severity). The vulnerability requires local access with relatively high attack complexity but no special privileges, though user interaction is necessary for exploitation. While the integrity impact is limited, an attacker could achieve high availability impact through denial of service by triggering insufficient memory allocation for large tensor operations. Currently, there is no evidence of active exploitation in the wild, as CVE-2026-40448 does not appear on the Known Exploited Vulnerabilities catalog and has not generated significant community attention. The EPSS score of 0.00013 indicates this remains a low-probability target for opportunistic exploitation at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.30.0CPE matchmatch criteria | cpe:2.3:a:samsung:one:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.