The vulnerability arises from a missing bounds check in the operator lookup logic used when loading model files in Samsung Open Source:ONE. If an attacker supplies a model file containing an operator index outside the valid range, the program may read memory beyond the intended array boundaries. This out‑of‑bounds access can lead to memory corruption, potentially allowing the attacker to execute arbitrary code or cause a denial of service. The weakness corresponds to CWE‑129, indicating a signed integer overflow or out‑of‑range index issue. Based on the description, it is inferred that an attacker can supply a malicious model file to trigger the flaw during the loading process.

The affected product is Samsung Open Source:ONE. Versions prior to commit 1.30.0 are vulnerable. No specific sub‑product names are provided, so all releases of the framework before that commit are impacted.

The CVSS v3 score is 5.5, indicating a medium severity vulnerability. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local execution of a crafted model during the loading process; no network exposure is described, so exploitation requires an attacker that can influence the model loading operation. Given the moderate CVSS score and lack of exploitation evidence, the overall risk is medium, but the potential impact of arbitrary code execution warrants prompt attention.