Samsung Escargot CVE-2026-118435

Per PR #1750, the out-of-bounds write occurs in escargot's code-cache writer (CodeCacheWriter::storeInterpretedCodeBlock / storeByteCodeBlock), where the serialization buffer was sized for 2*sizeof(bool) per entry instead of 3, so a flag array is written past the allocation; the accompanying TaggedTemplateExpressionNode change and new ChainedTaggedTemplates test indicate the condition is reached while handling chained tagged template literals. Concrete prerequisites: (1) an application embedding escargot with the code-cache feature enabled, since the vulnerable path is the cache serializer; and (2) the engine must parse/compile attacker-controlled JavaScript exercising chained tagged templates. Limiting factors: UI:R means a user or host application must actually run the script; impact is capped (C:N, I:L, A:L) at a bounded overwrite rather than demonstrated full control; and exposure is confined to deployments where escargot is embedded and code caching is active - a non-default-for-everyone configuration that must be verified per build.

This is a medium-severity issue (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) that signals a real but bounded concern rather than an emergency. The vuln.today decision label is 'this_month', consistent with the moderate CVSS and the absence of urgent exploitation signals. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit identified at time of analysis - the only reference is the vendor fix (Samsung escargot PR #1750), not a working exploit. The CVSS vector reports UI:R, meaning the engine must actually process attacker-influenced JavaScript, and the impact metrics (C:N, I:L, A:L) reflect a limited out-of-bounds write rather than demonstrated code execution; the source diff shows a one-element under-allocation (2→3 sizeof(bool)) in the code-cache serializer, which is consistent with a modest, not fully-controlled, overwrite. Real priority is therefore moderate and strongly conditioned on deployment: EPSS is not available to corroborate, impact is capped at low, and the affected component is an embedded JavaScript engine whose exposure depends entirely on where and how it is embedded. Note the code-cache writer is involved, so exploitation likely requires that optional feature to be enabled - verify against your build configuration.

An application embedding Samsung's escargot engine with code caching enabled parses attacker-supplied JavaScript containing chained tagged template expressions; during serialization of the compiled block the code-cache buffer is under-allocated, producing an out-of-bounds write. No standalone proof-of-concept exists, only the vendor fix PR, and successful triggering requires the victim application to run the malicious script (UI:R).