What is the CVSS score of CVE-2026-25207?

CVE-2026-25207 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung Open Source are affected by CVE-2026-25207?

CVE-2026-25207 is a high-severity out-of-bounds write vulnerability in Samsung's Escargot JavaScript engine that enables local attackers to execute arbitrary code or corrupt memory through buffer…

How to fix or mitigate CVE-2026-25207?

Within 24 hours: inventory all systems running Escargot and identify affected versions (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 or prior); document business-critical dependencies. Within 7 days: evaluate Samsung advisory for recommended patching timeline and interim workarounds; restrict local access to Escargot processes where feasible. Within 30 days: monitor Samsung security advisories for patch release and apply immediately upon availability; validate remediation in non-production environment before production deployment.

Samsung Open Source CVE-2026-25207

EUVD-2026-21822 HIGH

Out-of-bounds Write (CWE-787)

2026-04-13 samsung.tv_appliance

GHSA-gr3v-vrmj-p33q

Buffer Overflow Memory Corruption Samsung Samsung Open Source Escargot

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:53 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 05:26 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21822

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 04:47 nvd

HIGH 7.4

DescriptionCVE.org

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

AnalysisAI

Out-of-bounds write in Samsung Open Source Escargot JavaScript engine allows local attackers to execute arbitrary code or corrupt memory through buffer overflow conditions. This vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and prior versions. With a 7.4 CVSS score (high confidentiality, integrity, and availability impact) but high attack complexity and local attack vector, exploitation requires specialized conditions. No public exploit identified at time of analysis, and EPSS data not available for this CVE.

Technical ContextAI

Escargot is Samsung's lightweight JavaScript engine designed for resource-constrained environments like smart TVs and IoT devices. This vulnerability (CWE-787: Out-of-bounds Write) represents a classic buffer overflow condition where the engine writes data beyond allocated memory boundaries during JavaScript execution. The affected component is identified by CPE cpe:2.3:a:samsung_open_source:escargot, specifically impacting the codebase at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. Out-of-bounds write vulnerabilities in JavaScript engines are particularly critical because they occur in memory-unsafe code paths during parsing, compilation, or execution of JavaScript, potentially allowing attackers to overwrite adjacent memory structures, function pointers, or control data. The Samsung TV appliance context suggests this engine runs in embedded systems where memory protections may be limited compared to desktop environments.

RemediationAI

Apply the patch available through Samsung Open Source Escargot GitHub pull request #1554 at https://github.com/Samsung/escargot/pull/1554 once merged and released. Monitor the Escargot repository for official release notes confirming the fix version and upgrade to that version immediately upon availability. For Samsung TV and appliance deployments, wait for vendor firmware updates that incorporate the patched Escargot engine and apply them through standard device update mechanisms. Until patches are deployed, implement defense-in-depth controls: restrict local access to affected devices, disable unnecessary JavaScript execution features if possible, implement application sandboxing or container isolation for Escargot processes, and monitor for abnormal memory usage patterns or crashes that could indicate exploitation attempts. Organizations embedding Escargot in custom products should review their build processes to ensure they can rapidly integrate upstream security fixes.