The vulnerability describes improper validation of STRING tensor offsets that can allow malformed string metadata to trigger out‑of‑bounds access during constant tensor import in Samsung Open Source ONE. This failure to enforce bounds checks could lead to corrupt memory or service instability when crafted data is processed; these outcomes are inferred from the nature of out‑of‑bounds issues and are not explicitly detailed in the CVE description.

Samsung Open Source:ONE installations built from any release prior to commit 1.30.0 are affected, as earlier versions lack the necessary bounds‑checking logic for string tensor imports.

The CVSS score of 6.6 indicates moderate severity, EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no documented exploitation to date. Based on the description, the likely attack vector involves an attacker who can supply malformed string tensor metadata—this could occur in a local environment or potentially via remote input if the library processes untrusted data. The description does not provide evidence of exploitation, so these statements are inferred from the nature of the flaw.