EUVD-2026-21820
GHSA-f69x-9gf3-94pj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine allows local attackers to leak sensitive memory contents and cause denial of service. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and potentially other versions; the vulnerability requires local access and specific conditions to trigger but can expose confidential data and crash the application without authentication. No public exploit identified at time of analysis.
Technical ContextAI
Escargot is Samsung's lightweight JavaScript engine optimized for embedded devices and smart TV platforms. The vulnerability is an out-of-bounds read (CWE-125), a memory safety violation where the application reads memory beyond the intended buffer boundaries. This occurs in the engine's core parsing or execution logic, likely during string or array indexing operations. The CVSS vector indicates local attack vector (AV:L), suggesting the attacker must have local code execution or application access on the target device. Out-of-bounds reads can leak heap metadata, stack variables, or sensitive data stored in adjacent memory regions. The specific commit hash provided (97e8115ab1110bc502b4b5e4a0c689a71520d335) indicates a known affected version, though the wildcard CPE suggests multiple versions may be vulnerable.
RemediationAI
Samsung users should obtain the patched version of Escargot that includes the fix from GitHub pull request #1554 (https://github.com/Samsung/escargot/pull/1554). Device manufacturers and embedded system developers using Escargot should update their integration to include the out-of-bounds read fix. For Samsung appliances and smart TVs, check for firmware updates that incorporate the patched Escargot engine. Until patching is available, limiting local access to devices running Escargot and disabling JavaScript execution from untrusted sources provides temporary mitigation. Organizations should monitor Samsung security advisories for specific device firmware versions addressing this vulnerability.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today