An integer overflow occurs in the source‑bounds check within the Memory::init() function of Samsung Walrus. A crafted WebAssembly module that performs a 32‑bit unsigned addition that overflows causes the bounds check to be bypassed, permitting an out‑of‑bounds heap read. The flaw can be triggered remotely by submitting such a module and results in a denial‑of‑service that disrupts the Walrus runtime. This is a classic integer‑overflow weakness (CWE‑190) that jeopardizes availability.

The vulnerability exists in Samsung Walrus on all platforms and is present in the code base at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443. No specific version number is given, so any deployment of Walrus that has not incorporated the patch for this commit is potentially affected.

The CVSS score of 6.2 indicates a moderate severity level. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so active exploitation is not known. The flaw is exploitable remotely: an attacker only needs the ability to load a malicious WebAssembly module into Walrus. Once such a module is executed, the integer overflow results in an out‑of‑bounds memory read that can terminate the application. The attack requires some skill to craft the offending module, but no privileged access or additional platform‑specific conditions are required.