EUVD-2026-21826
GHSA-rwxh-99xg-w46m
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine exposes sensitive memory content to remote attackers through user interaction. The vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and allows information disclosure with partial availability impact. CVSS 5.9 (medium) reflects the requirement for user interaction and high complexity attack prerequisites, though the memory exposure potential warrants monitoring for patches.
Technical ContextAI
Escargot is Samsung's lightweight JavaScript engine designed for embedded and IoT devices. The vulnerability is an out-of-bounds read (CWE-125), a memory safety flaw where the engine attempts to access array or buffer memory beyond allocated boundaries. This typically occurs in parser, lexer, or expression evaluation logic where bounds checking is insufficient. The memory read does not require elevated privileges (PR:N in CVSS vector) but depends on user interaction (UI:R) to trigger malicious JavaScript or HTML content. Remote attackers exploit this by crafting JavaScript code or embedding it in web content that causes the engine to read past buffer limits, leaking adjacent memory containing potentially sensitive data.
RemediationAI
Patch availability is indicated via GitHub PR #1554 (https://github.com/Samsung/escargot/pull/1554), which addresses the out-of-bounds read. Organizations should update Escargot to the patched commit (post-97e8115ab1110bc502b4b5e4a0c689a71520d335). Users of Samsung devices embedding Escargot should monitor Samsung's security advisories and apply firmware updates when released. No active workaround mitigates the memory read itself, but restricting untrusted JavaScript execution or applying network-level content filtering reduces exposure in the interim.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today