Integer overflow in the buffer size calculation within Samsung Open Source ONE can cause out-of-bounds memory access when the system processes large tensors. This flaw could lead to memory corruption, potentially resulting in a denial of service or enabling further exploitation if an attacker can influence the contents of the corrupted memory. The flaw is classified as CWE‑190, reflecting a classic integer overflow weakness.

The vulnerability affects the Samsung Open Source ONE platform. Versions released before the 1.30.0 commit are vulnerable. The specific affected build references commit history and indicates that all releases prior to that point use the vulnerable buffer size calculation.

The CVSS score is 6.6, indicating medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploitation. Likely attack vectors involve feeding excessively large tensors into the system; if the platform offers a remote API, an unauthenticated or authenticated attacker could trigger the overflow by submitting a crafted payload, while a local attacker would need access to run code with sufficient privilege to manipulate tensor inputs.