CVE-2026-40448

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE. Affected version is prior to commit  1.30.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-404496.6Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source OCVE-2026-40453.7A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipuCVE-2026-404506.6Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption fCVE-2026-404515.1DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to eCVE-2026-404527.5Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-CVE-2026-404539.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandECVE-2026-404547.5Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deseCVE-2026-404558.6An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insuffiCVE-2026-404568.6An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passeCVE-2026-404572.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and CVE-2026-404586.5PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited byCVE-2026-404598.8PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based sea
CVE-2026-40448: Medium severity, CVSS 5.3 | Vulnix