Security advisory

{
  "id": "bd48966d33ac42518e347ec6641971ef0bb27cea2508fabf8de5b5cb4d500659",
  "url": "https://osv.dev/vulnerability/CVE-2024-32673",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2024-32673",
    "summary": "Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue. This issue affects Walrus: before 72c7230f32a0b791355bbdfc78669701024b0956.",
    "evidence": "osv:CVE-2024-32673",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-32673",
      "aliases": [
        "CVE-2024-32673"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Clear"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/samsung/walrus",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "72c7230f32a0b791355bbdfc78669701024b0956"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32673.json",
            "vanir_signatures": [
              {
                "id": "CVE-2024-32673-480c4fb3",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "291574002390734569796722475090881805414",
                    "74060478923918292088248949539399807217",
                    "179241539531136150613646247748070079597",
                    "126516323548333660699421547362527911966",
                    "100948235923904752954364902426881833771",
                    "82307836608214648431278730154334299919",
                    "160711307499732708719967209986641108977",
                    "184691794712616290451256080168391761958",
                    "47761707496941668379629955558564938496",
                    "264905625301416761227877345937748220105",
                    "172743416349237054899637375983559789034",
                    "329002301625942067565012032751527620522",
                    "33294119971305020880470996766823683935",
                    "79364116790733276377892998408585999645",
                    "97519983147246684563580250031695401896",
                    "219050212147814804329349371016155590856",
                    "244001747695586604015087921364039514743",
                    "271874700994394984619029594912899047239",
                    "281410681021619003124673738949294331330",
                    "108828447998362360214599334645498888161",
                    "88421474148356893161102540302959849412",
                    "136487332117419817023413131367114941851",
                    "126814780592254514743666592874454584053",
                    "162555896640319354482469577968713654012",
                    "243803153886346490950516457398386052970",
                    "138716717441732667155690513430917859201",
                    "147532779785015608562502341403900631223",
                    "26891207635836122710493792229669259477"
                  ]
                },
                "source": "https://github.com/samsung/walrus/commit/72c7230f32a0b791355bbdfc78669701024b0956",
                "target": {
                  "file": "src/parser/WASMParser.cpp"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2024-32673-50189621",
                "digest": {
                  "length": 473,
                  "function_hash": "107990484653941406461631945175465482008"
                },
                "source": "https://github.com/samsung/walrus/commit/72c7230f32a0b791355bbdfc78669701024b0956",
                "target": {
                  "file": "third_party/wabt/src/walrus/binary-reader-walrus.cc",
                  "function": "ReadWasmBinary"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2024-32673-cfe4f598",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "119777557260802328754161574694508320494",
                    "229729251131929355381233806697589491957",
                    "86694842207579749046552330223850475586",
                    "117313241876813067155565368157617896210",
                    "63514513790157723073796871580882076718",
                    "121420427463877589170525921338992470910",
                    "193700464911571765382666197401246189028",
                    "110322760322510143773506679935074523",
                    "182018214171139917130591400967439110693",
                    "163010812714907437100737208361345523500",
                    "228734414208525623601133129206501182152"
                  ]
                },
                "source": "https://github.com/samsung/walrus/commit/72c7230f32a0b791355bbdfc78669701024b0956",
                "target": {
                  "file": "third_party/wabt/src/walrus/binary-reader-walrus.cc"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-08T07:05:35Z"
          }
        }
      ],
      "modified": "2026-10-08T07:05:35.456069015Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32673.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-32673",
        "https://github.com/Samsung/walrus/pull/241",
        "https://github.com/Samsung/walrus"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-129"
        ],
        "cna_assigner": "samsung.tv_appliance",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32673.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-32673",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 98622,
  "published_at": "2024-07-03T01:21:16.898+00:00"
}