EUVD-2026-21762Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of untrusted data vulnerability in Samsung Open Source Escarogt Java Script allows denial of service condition via process abort.
This issue affects escarogt prior to commit hash
97e8115ab1110bc502b4b5e4a0c689a71520d335
AnalysisAI
Deserialization of untrusted data in Samsung Open Source Escargot JavaScript engine prior to commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 allows local attackers without privileges to trigger a denial of service condition via process abort. The vulnerability exploits unsafe deserialization of Java objects, resulting in application termination rather than code execution. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
Samsung Escargot is a JavaScript engine implemented in Java used in Samsung TV and appliance platforms. The vulnerability resides in the deserialization logic (CWE-502: Deserialization of Untrusted Data), a well-documented attack surface where untrusted serialized objects are reconstructed without proper validation. When a crafted serialized Java object is deserialized, it triggers an unhandled exception or unsafe operation that causes the process to abort. This is distinct from remote code execution vulnerabilities in deserialization; this instance results in availability impact only. The affected component processes JavaScript in Samsung devices, making it relevant to embedded systems and IoT contexts where the engine is embedded in TV firmware or appliance operating systems.
RemediationAI
Update Samsung Open Source Escargot to a version at or after commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. Upstream fix details are available in Samsung's GitHub repository at https://github.com/Samsung/escargot/pull/1554. For Samsung device owners, check for firmware updates through Samsung's support portal or automatic update mechanisms, as the engine fix will be included in future device firmware releases. Until patching is possible, restrict local code execution privileges and limit JavaScript engine exposure to untrusted input sources. Implement input validation or sanitization if feasible for serialized object handling upstream of the deserialization point.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today