EUVD-2026-40248
GHSA-jpx9-q676-jrjx
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
TOCTOU inherently requires winning a timing race, warranting AC:H; AV:L and PR:N retained as exploitation occurs via local JS execution without OS privileges.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
1DescriptionCVE.org
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions.
This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d.
AnalysisAI
Time-of-check time-of-use (TOCTOU) race condition in Samsung's open-source Escargot JavaScript engine exposes systems - notably Samsung TV appliances - to local exploitation resulting in limited confidentiality, integrity, and availability impact. The flaw exists at a specific upstream commit (bab3a5797557014ce3c2e28419a6310cfba90d0d) and allows an attacker who can execute code in the same environment to exploit a timing window between a security check and the subsequent use of a resource. No active exploitation has been identified at time of analysis, but a fix commit is available upstream.
Technical ContextAI
Escargot is Samsung's open-source lightweight JavaScript engine (cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*), designed for resource-constrained embedded environments such as Samsung smart TV appliances. The root cause is CWE-367 (TOCTOU Race Condition): the engine performs a security-relevant check on a shared resource and then acts on that resource without holding an exclusive lock, leaving a window during which another thread or execution context can alter the resource's state. This class of vulnerability is inherent to concurrent or event-driven runtimes where state is mutated between validation and consumption. The affected revision is pinned to commit bab3a5797557014ce3c2e28419a6310cfba90d0d; the CPE wildcard on version indicates all prior versions through that commit are potentially affected.
RemediationAI
Upstream fix available via GitHub commit 9e8084ecc2f68e8584d389414c3f37fda12dab7d at https://github.com/Samsung/escargot/commit/9e8084ecc2f68e8584d389414c3f37fda12dab7d; a released tagged version incorporating this fix has not been independently confirmed from available data. Integrators and downstream consumers (including Samsung TV firmware teams) should update Escargot to a build that includes this commit. As a compensating control where patching is not immediately feasible, restrict the execution of untrusted or third-party JavaScript within the Escargot runtime environment - note that this may disable app functionality on smart TV platforms. Monitor Samsung's security advisories for an official firmware update that bundles the patched engine. No vendor advisory URL beyond the GitHub commit was present in the available data.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.0.0
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.0.0.
Out-of-bounds read and reachable assertion vulnerabilities in Samsung's open-source Escargot JavaScript engine allow a l
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today