CVE-2026-40449

CVE-2026-40449 is an integer overflow vulnerability in Samsung Open Source ONE prior to version 1.30.0 that allows out of bounds memory access when processing large tensors through a buffer size calculation error. The flaw affects the tensor processing functionality of the Samsung Open Source ONE framework, potentially impacting applications that handle large machine learning models or data structures. This vulnerability carries a CVSS score of 6.6 (Medium severity) with a local attack vector requiring user interaction, though it can result in both confidentiality and integrity compromise along with high availability impact. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no indication of active exploitation in the wild, with very low EPSS probability (0.000120000) suggesting limited real-world threat activity. Community attention remains minimal as indicated by its inactive status on vulnerability tracking lists, though organizations running affected versions should prioritize patching to version 1.30.0 or later as a preventive measure.