Description

Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses the bounds check. This issue affects Walrus: ff3bf5ff5c4878f8e5572c9593d303f6bc997443.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-07T03:17:19.530Z",
  "pubdate": "2026-09-07T03:17:19.530Z",
  "executiveSummary": "An integer overflow vulnerability exists in the Memory::init() function within the Samsung Walrus runtime environment, specifically affecting the source-bounds checking mechanism.\nThe flaw occurs during the validation of memory offsets, where a 32-bit unsigned addition can wrap around, effectively bypassing critical boundary constraints.\nThis vulnerability enables a remote attacker to trigger an out-of-bounds heap read by providing a maliciously crafted WebAssembly module.\nThe successful exploitation of this flaw can result in a denial of service (DoS) by causing memory access violations, potentially exposing sensitive data stored in heap memory or crashing the runtime process.\nThe issue affects Walrus commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms.\nThere are no specific authentication or elevated privilege requirements noted for the initial trigger, as the attack vector is facilitated through the parsing of untrusted WebAssembly modules.",
  "technicalDetails": "The vulnerability resides within src/runtime/Memory.cpp in the Memory::init() function, which is responsible for initializing linear memory structures in the Walrus WebAssembly runtime.\nThe root cause is an improper integer arithmetic operation during the verification of source bounds. The runtime performs an unsigned 32-bit addition when calculating memory offsets or size constraints. If the input values provided in the WebAssembly module are specifically crafted such that their sum exceeds the maximum value representable by a 32-bit unsigned integer (UINT32_MAX), the operation wraps around to a small value.\nBecause the bounds-checking logic relies on the result of this addition to validate memory access, the wrapped value bypasses the intended boundary constraints. Instead of rejecting the request as exceeding the allocated heap size, the runtime erroneously concludes that the requested offset is within the valid memory region.\nThe attack flow initiates when the Walrus runtime parses and executes a malicious WebAssembly module. An attacker embeds an engineered memory operation—typically related to memory initialization (e.g., memory.init or data segment operations)—within the module. The runtime's validation logic, which should identify the out-of-bounds request, is circumvented due to the integer wrap-around.\nUpon bypass, the execution environment proceeds to access heap memory locations outside the intended buffer range. This out-of-bounds read allows the runtime to read data from adjacent heap objects, which may include sensitive information, metadata, or pointers. If the resulting read operation accesses unmapped or protected memory pages, the process triggers a segmentation fault or a memory access exception, leading to a denial of service (DoS).\nThis vulnerability does not require prior authentication or elevated privileges, provided the environment permits the execution of the attacker-supplied WebAssembly code. The impact is primarily categorized as an information disclosure and an availability compromise, depending on the memory layout and the state of the heap at the time of execution."
}