What is the CVSS score of CVE-2026-25205?

CVE-2026-25205 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung are affected by CVE-2026-25205?

Samsung Escargot JavaScript engine contains a heap-based buffer overflow (CVE-2026-25205, CVSS 8.1) affecting specific commit versions, with potential for memory corruption and system instability…

How to fix or mitigate CVE-2026-25205?

Within 24 hours: Inventory all systems and applications using Samsung Escargot JavaScript engine, particularly those running commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 or earlier. Within 7 days: Contact Samsung for confirmed patched version availability and timeline; monitor Samsung security advisories for official release. Within 30 days: Test and deploy vendor-released patch to all affected Escargot instances once formally validated by Samsung; document and validate remediation across inventory.

Samsung CVE-2026-25205

EUVD-2026-21819 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-13 samsung.tv_appliance

GHSA-vwvq-v5q8-rq3p

Samsung Heap Overflow Buffer Overflow

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 21:23 vuln.today

cvss_changed

CVSS changed

Apr 13, 2026 - 06:22 NVD

8.1 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 13, 2026 - 05:26 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21819

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 04:38 nvd

HIGH 7.4

DescriptionCVE.org

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335

AnalysisAI

Heap-based buffer overflow in Samsung Open Source Escargot JavaScript engine enables out-of-bounds memory writes with high integrity and availability impact through local attack vectors. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. CVSS 8.1 severity driven by scope change and low attack complexity despite local access requirement. Upstream fix available (PR/commit); released patched version not independently confirmed. No public exploit identified at time of analysis, and exploitation requires high attack complexity (AC:H), limiting immediate risk despite elevated CVSS score.

Technical ContextAI

Samsung Open Source Escargot is a lightweight JavaScript engine optimized for IoT devices and embedded systems, commonly deployed in Samsung Tizen-based smart TVs and appliances. This vulnerability manifests as a CWE-122 heap-based buffer overflow, where insufficient bounds checking during heap memory operations allows writes beyond allocated buffer boundaries. The out-of-bounds write occurs within the JavaScript runtime's memory management layer, potentially corrupting adjacent heap structures. The affected codebase (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335) predates the fix in GitHub PR #1554. Heap overflows in JavaScript engines are particularly dangerous as they can compromise the security sandbox and enable arbitrary code execution through controlled memory corruption, though the local attack vector (AV:L) constrains remote exploitation scenarios.

RemediationAI

Upgrade to Escargot version incorporating the fix from GitHub PR #1554 available at https://github.com/Samsung/escargot/pull/1554. Review the pull request diff to identify specific code changes addressing the heap overflow vulnerability and verify integration into your Escargot build. For Samsung Tizen device users, monitor Samsung security bulletins for firmware updates addressing this vulnerability and apply updates when released. Organizations maintaining custom Escargot builds should cherry-pick commit changes from PR #1554 or rebase against current upstream main branch. As interim mitigation where patching is not immediately feasible, restrict local system access through principle of least privilege, disable unnecessary JavaScript execution contexts in embedded environments, and deploy runtime memory protection mechanisms such as ASLR and stack canaries if supported by the target platform. No workaround fully mitigates heap corruption vulnerabilities, making patching the definitive remediation.