What is the CVSS score of CVE-2026-25208?

CVE-2026-25208 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung are affected by CVE-2026-25208?

CVE-2026-25208 is a high-severity integer overflow vulnerability in Samsung's Escargot JavaScript engine that enables remote code execution without authentication on network-connected devices.

How to fix or mitigate CVE-2026-25208?

Within 24 hours: inventory all Samsung devices and applications using Escargot engine in your environment and isolate from critical networks if feasible. Within 7 days: contact Samsung support to confirm patched firmware availability and establish deployment timeline; monitor CISA KEV catalog and Samsung security advisories for confirmed patch release. Within 30 days: deploy vendor-released patches to all affected devices and validate successful application; implement network segmentation to limit lateral movement from compromised devices.

Samsung CVE-2026-25208

EUVD-2026-21824 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-04-13 samsung.tv_appliance

GHSA-w5xm-3w7h-mqrh

Buffer Overflow Samsung Integer Overflow

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:53 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 05:27 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21824

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 04:49 nvd

HIGH 8.1

DescriptionCVE.org

Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

AnalysisAI

Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authentication via network-delivered crafted JavaScript code. Affects commit 97e8115ab and prior versions. No public exploit identified at time of analysis, though upstream fix available (PR/commit); released patched version not independently confirmed. With CVSS 8.1 (High) and network attack vector requiring high complexity, this represents significant risk for devices and applications embedding the Escargot engine, particularly Samsung smart TV and appliance platforms.

Technical ContextAI

Samsung Escargot is a lightweight JavaScript engine designed for memory-constrained environments such as IoT devices, smart TVs, and embedded appliances. This vulnerability stems from CWE-190 (Integer Overflow or Wraparound), where arithmetic operations on integer values can wrap around to produce unexpectedly small results. When these values control buffer sizes or memory allocation, the overflow enables writing beyond allocated boundaries-creating a classic buffer overflow condition. The affected component is identified by CPE as samsung_open_source:escargot, with the specific vulnerable commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335. Integer overflows in JavaScript engines are particularly dangerous because JavaScript's dynamic typing and automatic conversions can obscure malicious arithmetic until runtime, when memory corruption occurs during object allocation, array indexing, or string operations.

RemediationAI

Upstream fix available via GitHub Pull Request #1554 at https://github.com/Samsung/escargot/pull/1554; released patched version not independently confirmed. For developers integrating Escargot: immediately update to a commit incorporating PR #1554 or later, rebuild JavaScript engine binaries, and redeploy to affected products. For Samsung device owners: monitor vendor security bulletins for firmware updates addressing CVE-2026-25208 and apply updates immediately when available. As a temporary mitigation, restrict network access to JavaScript execution contexts where feasible, though this may significantly impact device functionality. Enterprises deploying Samsung smart appliances or TVs should inventory affected devices, prioritize those with external network exposure, and establish expedited patch deployment procedures once vendor firmware becomes available.